]> git.ipfire.org Git - thirdparty/nftables.git/commitdiff
evaluate: disregard ct address matching without family
authorPablo Neira Ayuso <pablo@netfilter.org>
Fri, 31 Jul 2020 18:10:11 +0000 (20:10 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 31 Jul 2020 18:16:17 +0000 (20:16 +0200)
The following rule:

 # nft add rule ip x y ct original daddr @servers

breaks with:

 # nft list ruleset
nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed > 0' failed.
Aborted

Bail out if this syntax is used, instead users should rely on:

 # nft add rule ip x y ct original ip daddr @servers
                                   ~~

which uses NFT_CT_{SRC,DST}_{IP,IP6} in the bytecode generation.

This issue is described in 7f742d0a9071 ("ct: support for
NFT_CT_{SRC,DST}_{IP,IP6}").

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src/evaluate.c

index a99b1143734290a6b36e7e9e2b481bdf583babc1..b64ed3c0c6a48380b075dd6296e430dfff3d21ff 100644 (file)
@@ -1907,6 +1907,12 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
                                                         right);
                        /* fall through */
                case EXPR_SET_REF:
+                       if (rel->left->etype == EXPR_CT &&
+                           (rel->left->ct.key == NFT_CT_SRC ||
+                            rel->left->ct.key == NFT_CT_DST))
+                               return expr_error(ctx->msgs, left,
+                                                 "specify either ip or ip6 for address matching");
+
                        /* Data for range lookups needs to be in big endian order */
                        if (right->set->flags & NFT_SET_INTERVAL &&
                            byteorder_conversion(ctx, &rel->left, BYTEORDER_BIG_ENDIAN) < 0)