evaluate: check for concatenation in set data datatype

When adding this rule with an existing map:

  add rule nat x y meta l4proto { tcp, udp } dnat ip to ip daddr . th dport map @fwdtoip_th

reports a bogus:

Error: datatype mismatch: expected IPv4 address, expression has type
concatenation of (IPv4 address, internet network service)

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index b39f45981c422e14bcb12214444293eafa05721a..f3d7ca42ce577e994f365cf8cb0e21c99bcc45d4 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3244,7 +3244,8 @@ static bool nat_concat_map(struct eval_ctx *ctx, struct stmt *stmt)
                if (expr_evaluate(ctx, &stmt->nat.addr->mappings))
                        return false;
 
-               if (stmt->nat.addr->mappings->set->data->etype == EXPR_CONCAT) {
+               if (stmt->nat.addr->mappings->set->data->etype == EXPR_CONCAT ||
+                   stmt->nat.addr->mappings->set->data->dtype->subtypes) {
                        stmt->nat.type_flags |= STMT_NAT_F_CONCAT;
                        return true;
                }

diff --git a/tests/shell/testcases/sets/0067nat_concat_interval_0 b/tests/shell/testcases/sets/0067nat_concat_interval_0
index 3d1b62d69b264fbb8c60d396f6dded9f503823c8..530771b0016cbcfc26dad8861d899adce3e049e3 100755 (executable)
--- a/tests/shell/testcases/sets/0067nat_concat_interval_0
+++ b/tests/shell/testcases/sets/0067nat_concat_interval_0
@@ -31,3 +31,14 @@ EXPECTED="table ip nat {
 }"
 
 $NFT -f - <<< $EXPECTED
+
+EXPECTED="table ip nat {
+       map fwdtoip_th {
+               type ipv4_addr . inet_service : interval ipv4_addr . inet_service
+               flags interval
+               elements = { 1.2.3.4 . 10000-20000 : 192.168.3.4 . 30000-40000 }
+       }
+}"
+
+$NFT -f - <<< $EXPECTED
+$NFT add rule ip nat prerouting meta l4proto { tcp, udp } dnat to ip daddr . th dport map @fwdtoip_th

diff --git a/tests/shell/testcases/sets/dumps/0067nat_concat_interval_0.nft b/tests/shell/testcases/sets/dumps/0067nat_concat_interval_0.nft
index c565d21f8acc871a020ff5cc18c64295266db1ed..3226da157272bcbc0bc9a290f85cd29a45a2ef41 100644 (file)
--- a/tests/shell/testcases/sets/dumps/0067nat_concat_interval_0.nft
+++ b/tests/shell/testcases/sets/dumps/0067nat_concat_interval_0.nft
@@ -11,9 +11,16 @@ table ip nat {
                elements = { 192.168.1.2 . 192.168.2.2 : 127.0.0.0/8 . 42-43 }
        }
 
+       map fwdtoip_th {
+               type ipv4_addr . inet_service : interval ipv4_addr . inet_service
+               flags interval
+               elements = { 1.2.3.4 . 10000-20000 : 192.168.3.4 . 30000-40000 }
+       }
+
        chain prerouting {
                type nat hook prerouting priority dstnat; policy accept;
                ip protocol tcp dnat ip to ip saddr map @ipportmap
                ip protocol tcp dnat ip to ip saddr . ip daddr map @ipportmap2
+               meta l4proto { tcp, udp } dnat ip to ip daddr . th dport map @fwdtoip_th
        }
 }