]> git.ipfire.org Git - thirdparty/nftables.git/commit
src: tunnel src/dst must be a symbolic expression
authorFlorian Westphal <fw@strlen.de>
Thu, 16 Oct 2025 14:59:34 +0000 (16:59 +0200)
committerFlorian Westphal <fw@strlen.de>
Fri, 17 Oct 2025 07:41:47 +0000 (09:41 +0200)
commit667a618083f755eb12b73a69e32fe94e128ec8b3
tree22e0051fd528d32fdaa94a59f59d52bb3a705b4c
parentf9047c1f1a4e5841785a39049d47bba4bfdb592b
src: tunnel src/dst must be a symbolic expression

Included bogons crash with segfault and assertion.  After fix:

tunnel_with_garbage_dst:3:12-14: Error: syntax error, unexpected tcp, expecting string or quoted string or string with a trailing asterisk or '$'
  ip saddr tcp dport { }
           ^^^
The parser change restricts the grammar to no longer allow this,
we would crash here because we enter payload evaluation path that
tries to insert a dependency into the rule, but we don't have one
(ctx->rule and ctx->stmt are NULL as expected here).

The eval stage change makes sure we will reject non-value symbols:

tunnel_with_anon_set_assert:1:12-31: Error: must be a value, not set
define s = { 1.2.3.4, 5.6.7.8 }
           ^^^^^^^^^^^^^^^^^^^^

Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
src/evaluate.c
src/parser_bison.y
tests/shell/testcases/bogons/nft-f/tunnel_with_anon_set_assert [new file with mode: 0644]
tests/shell/testcases/bogons/nft-f/tunnel_with_garbage_dst [new file with mode: 0644]