From: Florian Westphal Date: Thu, 20 Mar 2025 08:39:20 +0000 (+0100) Subject: evaluate: don't allow nat map with specified protocol X-Git-Tag: v1.1.2~40 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=43cf4a2973ee9e3ab20edce47c6a054485707592;p=thirdparty%2Fnftables.git evaluate: don't allow nat map with specified protocol Included bogon asserts: src/netlink_linearize.c:1305: netlink_gen_nat_stmt: Assertion `stmt->nat.proto == NULL' failed. The comment right above the assertion says: nat_stmt evaluation step doesn't allow STMT_NAT_F_CONCAT && stmt->nat.proto. ... except it does allow it. Disable this. Fixes: c68314dd4263 ("src: infer NAT mapping with concatenation from set") Signed-off-by: Florian Westphal Reviewed-by: Pablo Neira Ayuso --- diff --git a/src/evaluate.c b/src/evaluate.c index 95b9b3d5..3a453d01 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -4196,6 +4196,10 @@ static int stmt_evaluate_nat_map(struct eval_ctx *ctx, struct stmt *stmt) int addr_type; int err; + if (stmt->nat.proto) + return stmt_binary_error(ctx, stmt, stmt->nat.proto, + "nat map and protocol are mutually exclusive"); + if (stmt->nat.family == NFPROTO_INET) expr_family_infer(pctx, stmt->nat.addr, &stmt->nat.family); diff --git a/tests/shell/testcases/bogons/nat_map_and_protocol_assert b/tests/shell/testcases/bogons/nat_map_and_protocol_assert new file mode 100644 index 00000000..67f2ae87 --- /dev/null +++ b/tests/shell/testcases/bogons/nat_map_and_protocol_assert @@ -0,0 +1,5 @@ +table t { + chain y { + snat to ip saddr . tcp sport map { 1.1.1.1 . 1 : 1.1.1.2 . 1 } : 6 + } +}