evaluate: merge nested set flags

A set may contain a nested set element definition, merge the nested set
flags so we don't hit:

 BUG: invalid data expression type range
 nft: netlink.c:400: netlink_gen_data: Assertion `0' failed.
 Aborted

With the following example ruleset:

 define dnat_ports      = { 1234-1567 }
 define port_allow      = {
        53,             # dns
        $dnat_ports,    # dnat
 }

 add rule x y tcp dport $port_allow accept

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1145
Fixes: a6b75b837f5e ("evaluate: set: Allow for set elems to be sets")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index cee992728db9d6444ad1b5650fe51cfa5307acb5..ec898033c9847f02fbae00d07a0ce3d30f8b783b 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1150,6 +1150,7 @@ static int expr_evaluate_set(struct eval_ctx *ctx, struct expr **expr)
                    i->key->ops->type == EXPR_SET) {
                        struct expr *new = expr_clone(i->key);
 
+                       set->set_flags |= i->key->set_flags;
                        list_replace(&i->list, &new->list);
                        expr_free(i);
                        i = new;