]> git.ipfire.org Git - thirdparty/nftables.git/commit
evaluate: check element key vs. set definition
authorFlorian Westphal <fw@strlen.de>
Thu, 26 Jun 2025 14:52:31 +0000 (16:52 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 13 Aug 2025 18:51:08 +0000 (20:51 +0200)
commit3d754c8614618a7723faa4ba2e06b750f2c56c00
tree51e4e65af131bcb0f83d484a686ad1a77e4e6967
parentaa36b04c2ff693c03ce6586a7a41b0fb8e73e4e5
evaluate: check element key vs. set definition

commit 7f4d7fef31bd282b8e37d6d401208535a1e74d17 upstream.

Included bogon asserts with:
 src/datatype.c:253: symbolic_constant_print: Assertion `expr->len / BITS_PER_BYTE <= sizeof(val)' failed.

Resolve this by validating that the set element key matches the set key
definition.

After this, loading the bogon file gives:
Error: Element mismatches set definition, expected concatenation of (IPv4 address, integer), not 'ICMP type'
elements = {redirect }
           ^^^^^^^^

Signed-off-by: Florian Westphal <fw@strlen.de>
src/evaluate.c
tests/shell/testcases/bogons/nft-f/symbolic_constant_print_assert [new file with mode: 0644]