]> git.ipfire.org Git - thirdparty/nftables.git/commit
evaluate: only allow stateful statements in set and map definitions
authorFlorian Westphal <fw@strlen.de>
Mon, 31 Mar 2025 15:23:20 +0000 (17:23 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 29 Jul 2025 00:38:28 +0000 (02:38 +0200)
commit7297f06c1cce3cbca47fa00e205ac5ccbccaf7c7
treefa0861397c084aed8519d4b9bad07edf164c199f
parent1be68cda23633048ce2f5bb2cc5393c666f0c583
evaluate: only allow stateful statements in set and map definitions

commit 0acd81559ec9efe2cc3d869bfc8e5a0b4d888456 upstream.

The bison parser doesn't allow this to happen due to grammar
restrictions, but the json input has no such issues.

The bogon input assigns 'notrack' which triggers:
BUG: unknown stateful statement type 19
nft: src/netlink_linearize.c:1061: netlink_gen_stmt_stateful: Assertion `0' failed.

After patch, we get:
Error: map statement must be stateful

Fixes: 07958ec53830 ("json: add set statement list support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
src/evaluate.c