evaluate: report missing interval flag when using prefix/range in concatenation

If set declaration is missing the interval flag, and user specifies an
element with either prefix or range, then bail out.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1592
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 073bf8717236bba7fca5106aa12d89f30490f721..9ae525769bc38d2ef228cc77fe60624fea68a5b5 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1431,10 +1431,9 @@ static int __expr_evaluate_set_elem(struct eval_ctx *ctx, struct expr *elem)
 static int expr_evaluate_set_elem(struct eval_ctx *ctx, struct expr **expr)
 {
        struct expr *elem = *expr;
+       const struct expr *key;
 
        if (ctx->set) {
-               const struct expr *key;
-
                if (__expr_evaluate_set_elem(ctx, elem) < 0)
                        return -1;
 
@@ -1451,9 +1450,19 @@ static int expr_evaluate_set_elem(struct eval_ctx *ctx, struct expr **expr)
                switch (elem->key->etype) {
                case EXPR_PREFIX:
                case EXPR_RANGE:
-                       return expr_error(ctx->msgs, elem,
-                                         "You must add 'flags interval' to your %s declaration if you want to add %s elements",
-                                         set_is_map(ctx->set->flags) ? "map" : "set", expr_name(elem->key));
+                       key = elem->key;
+                       goto err_missing_flag;
+               case EXPR_CONCAT:
+                       list_for_each_entry(key, &elem->key->expressions, list) {
+                               switch (key->etype) {
+                               case EXPR_PREFIX:
+                               case EXPR_RANGE:
+                                       goto err_missing_flag;
+                               default:
+                                       break;
+                               }
+                       }
+                       break;
                default:
                        break;
                }
@@ -1462,7 +1471,13 @@ static int expr_evaluate_set_elem(struct eval_ctx *ctx, struct expr **expr)
        datatype_set(elem, elem->key->dtype);
        elem->len   = elem->key->len;
        elem->flags = elem->key->flags;
+
        return 0;
+
+err_missing_flag:
+       return expr_error(ctx->msgs, key,
+                         "You must add 'flags interval' to your %s declaration if you want to add %s elements",
+                         set_is_map(ctx->set->flags) ? "map" : "set", expr_name(key));
 }
 
 static const struct expr *expr_set_elem(const struct expr *expr)

diff --git a/tests/shell/testcases/sets/errors_0 b/tests/shell/testcases/sets/errors_0
index 569f4ab830cd58d45a9123bae5f6108c1f676493..f2da43a009b93c410d73d2d8c0cf27fd5438476c 100755 (executable)
--- a/tests/shell/testcases/sets/errors_0
+++ b/tests/shell/testcases/sets/errors_0
@@ -38,4 +38,20 @@ create table inet filter
 set inet filter foo {}
 add element inet filter foo { foobar }"
 
+$NFT -f - <<< $RULESET
+if [ $? -eq 0 ]
+then
+       exit 1
+fi
+
+RULESET="table ip x {
+        map x {
+                type ifname . ipv4_addr : verdict
+                elements = { if2 . 10.0.0.2 : jump chain2,
+                             if2 . 192.168.0.0/24 : jump chain2 }
+        }
+
+        chain chain2 {}
+}"
+
 $NFT -f - <<< $RULESET || exit 0