evaluate: bogus error when adding devices to flowtable

commit 59d304f47a121afda867d792c709bc2c81946979 upstream.

Bail out if flowtable declaration is missing and no devices are
specified.

Otherwise, this reports a bogus error when adding new devices to an
existing flowtable.

 # nft -v
 nftables v1.0.9 (Old Doc Yak #3)
 # ip link add dummy1 type dummy
 # ip link set dummy1 up
 # nft 'create flowtable inet filter f1 { hook ingress priority 0; counter }'
 # nft 'add flowtable inet filter f1 { devices = { dummy1 } ; }'
 Error: missing hook and priority in flowtable declaration
 add flowtable inet filter f1 { devices = { dummy1 } ; }
                           ^^^^^^^^^^^^^^^^^^^^^^^^

Fixes: 5ad475fce5a1 ("evaluate: bail out if new flowtable does not specify hook and priority")
Reported-by: Martin Gignac <martin.gignac@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 616fc403b62c8d4da390c4a3aef41eda1e784361..acc69c68b13b7c1e8d6167a9faa95e18db8f8546 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -4746,7 +4746,7 @@ static int flowtable_evaluate(struct eval_ctx *ctx, struct flowtable *ft)
                return table_not_found(ctx);
 
        if (!ft_cache_find(table, ft->handle.flowtable.name)) {
-               if (!ft->hook.name)
+               if (!ft->hook.name && !ft->dev_expr)
                        return chain_error(ctx, ft, "missing hook and priority in flowtable declaration");
 
                ft_cache_add(flowtable_get(ft), table);

diff --git a/tests/shell/testcases/flowtable/0015destroy_0 b/tests/shell/testcases/flowtable/0015destroy_0
new file mode 100755 (executable)
index 0000000..cea3352
--- /dev/null
+++ b/tests/shell/testcases/flowtable/0015destroy_0
@@ -0,0 +1,20 @@
+#!/bin/bash -e
+
+# NFT_TEST_REQUIRES(NFT_TEST_HAVE_destroy)
+
+trap "ip link del dummy1" EXIT
+
+ip link add dummy1 type dummy
+ip link set dummy1 up
+
+$NFT add table t
+
+# pass for non-existent flowtable
+$NFT destroy flowtable t f
+
+# successfully delete existing flowtable
+$NFT add flowtable t f '{ hook ingress priority 10; devices = { lo }; }'
+
+$NFT 'add flowtable t f { devices = { dummy1 } ; }'
+
+$NFT destroy flowtable t f