evaluate: don't update cache for anonymous chains

Chain lookup needs a name, not a numerical id.
After patch, loading bogon gives following errors:

Error: No symbol type information a b index 1 10.1.26.a

v2: Don't return an error, just make it a no-op (Pablo Neira Ayuso)

Fixes: c330152b7f77 ("src: support for implicit chain bindings")
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/evaluate.c b/src/evaluate.c
index a27961193da5edc7f62c35cae26b428412e1d8d8..785c4fab6b3a3908cd37db40931f230b2c4d6be2 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -5371,6 +5371,10 @@ static int rule_cache_update(struct eval_ctx *ctx, enum cmd_ops op)
        if (!table)
                return table_not_found(ctx);
 
+       /* chain is anonymous, adding new rules via index is not supported. */
+       if (!rule->handle.chain.name)
+               return 0;
+
        chain = chain_cache_find(table, rule->handle.chain.name);
        if (!chain)
                return chain_not_found(ctx);

diff --git a/tests/shell/testcases/bogons/nft-f/null_deref_on_anon_chain_update_crash b/tests/shell/testcases/bogons/nft-f/null_deref_on_anon_chain_update_crash
new file mode 100644 (file)
index 0000000..310486c
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-f/null_deref_on_anon_chain_update_crash
@@ -0,0 +1,8 @@
+table ip f {
+        chain c {
+                jump {
+                        accept
+                }
+        }
+}
+a b index 1 10.1.26.a