netlink_delinearize: transform binary operation to prefix only with values

The following rule:

 nft add rule inet filter input ip6 saddr and ffff:ffff:ffff:ffff:: @allowable counter

when listing the ruleset becomes:

 ip6 saddr @allowable/64 counter packets 3 bytes 212

This transformation is unparseable, allow prefix transformation only for
values.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index d0438f44058defad4c4da6421f021e0942f16fb3..9e3ed53d09f1cb663faf2228fc06cad665819b83 100644 (file)
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -2102,7 +2102,7 @@ static void relational_binop_postprocess(struct rule_pp_ctx *ctx, struct expr *e
 
                expr_free(binop);
        } else if (binop->left->dtype->flags & DTYPE_F_PREFIX &&
-                  binop->op == OP_AND &&
+                  binop->op == OP_AND && expr->right->etype == EXPR_VALUE &&
                   expr_mask_is_prefix(binop->right)) {
                expr->left = expr_get(binop->left);
                expr->right = prefix_expr_alloc(&expr->location,