src: Set NFT_SET_CONCAT flag for sets with concatenated ranges

Pablo reports that nft, after commit 8ac2f3b2fca3 ("src: Add support
for concatenated set ranges"), crashes with older kernels (< 5.6)
without support for concatenated set ranges: those sets will be sent
to the kernel, which adds them without notion of the fact that
different concatenated fields are actually included, and nft crashes
while trying to list this kind of malformed concatenation.

Use the NFT_SET_CONCAT flag introduced by kernel commit ef516e8625dd
("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag") when
sets including concatenated ranges are sent to the kernel, so that
older kernels (with no knowledge of this flag itself) will refuse set
creation.

Note that, in expr_evaluate_set(), we have to check for the presence
of the flag, also on empty sets that might carry it in context data,
and actually set it in the actual set flags.

Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index fcc79386b3250590663378f8af9c5821e051a04d..759b17366f68f08c75c28c5b931d43ad37fec28a 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1382,10 +1382,16 @@ static int expr_evaluate_set(struct eval_ctx *ctx, struct expr **expr)
                        set->size      += i->size - 1;
                        set->set_flags |= i->set_flags;
                        expr_free(i);
-               } else if (!expr_is_singleton(i))
+               } else if (!expr_is_singleton(i)) {
                        set->set_flags |= NFT_SET_INTERVAL;
+                       if (i->key->etype == EXPR_CONCAT)
+                               set->set_flags |= NFT_SET_CONCAT;
+               }
        }
 
+       if (ctx->set && (ctx->set->flags & NFT_SET_CONCAT))
+               set->set_flags |= NFT_SET_CONCAT;
+
        set->set_flags |= NFT_SET_CONSTANT;
 
        datatype_set(set, ctx->ectx.dtype);
@@ -3463,6 +3469,7 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set)
                memcpy(&set->desc.field_len, &set->key->field_len,
                       sizeof(set->desc.field_len));
                set->desc.field_count = set->key->field_count;
+               set->flags |= NFT_SET_CONCAT;
        }
 
        if (set_is_datamap(set->flags)) {