src: expand create commands

create commands also need to be expanded, otherwise elements are never
evaluated:

 # cat ruleset.nft
 define ip-block-4 = { 1.1.1.1 }
 create set netdev filter ip-block-4-test {
        type ipv4_addr
	flags interval
	auto-merge
	elements = $ip-block-4
 }
 # nft -f ruleset.nft
 BUG: unhandled expression type 0
 nft: src/intervals.c:211: interval_expr_key: Assertion `0' failed.
 Aborted

Same applies to chains in the form of:

 create chain x y {
	counter
 }

which is also accepted by the parser.

Update tests/shell to improve coverage for these use cases.

Fixes: 56c90a2dd2eb ("evaluate: expand sets and maps before evaluation")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/libnftables.c b/src/libnftables.c
index ec902009e002f9db37f0dc3d89906c0db3a2471f..0dee1bacb0db3ed4e8558746cb2580bb1616b2a6 100644 (file)
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -532,7 +532,8 @@ static int nft_evaluate(struct nft_ctx *nft, struct list_head *msgs,
                collapsed = true;
 
        list_for_each_entry(cmd, cmds, list) {
-               if (cmd->op != CMD_ADD)
+               if (cmd->op != CMD_ADD &&
+                   cmd->op != CMD_CREATE)
                        continue;
 
                nft_cmd_expand(cmd);

diff --git a/tests/shell/testcases/include/0020include_chain_0 b/tests/shell/testcases/include/0020include_chain_0
index 8f78e8c606ec75b208cdf05ef73f500d688483e1..49b6f76c6a8df84bf1a5c2b758ca5d7c2a7a46e1 100755 (executable)
--- a/tests/shell/testcases/include/0020include_chain_0
+++ b/tests/shell/testcases/include/0020include_chain_0
@@ -20,4 +20,11 @@ RULESET2="chain inet filter input2 {
 
 echo "$RULESET2" > $tmpfile1
 
+RULESET3="create chain inet filter output2 {
+       type filter hook output priority filter; policy accept;
+       ip daddr 1.2.3.4 tcp dport { 22, 443, 123 } drop
+}"
+
+echo "$RULESET3" >> $tmpfile1
+
 $NFT -o -f - <<< $RULESET

diff --git a/tests/shell/testcases/include/dumps/0020include_chain_0.nft b/tests/shell/testcases/include/dumps/0020include_chain_0.nft
index 3ad6db14d2f5f00fa06ccb834949664a9e4c0c9c..bf596ffb30673ff5daa428042910a3ae5cf64b83 100644 (file)
--- a/tests/shell/testcases/include/dumps/0020include_chain_0.nft
+++ b/tests/shell/testcases/include/dumps/0020include_chain_0.nft
@@ -3,4 +3,9 @@ table inet filter {
                type filter hook input priority filter; policy accept;
                ip saddr 1.2.3.4 tcp dport { 22, 123, 443 } drop
        }
+
+       chain output2 {
+               type filter hook output priority filter; policy accept;
+               ip daddr 1.2.3.4 tcp dport { 22, 123, 443 } drop
+       }
 }

diff --git a/tests/shell/testcases/sets/0049set_define_0 b/tests/shell/testcases/sets/0049set_define_0
index 1d512f7b5a543e65823a1ce768534529ee6f5caf..756afdc1e9653b093ca97b62970e44cc1976699b 100755 (executable)
--- a/tests/shell/testcases/sets/0049set_define_0
+++ b/tests/shell/testcases/sets/0049set_define_0
@@ -14,3 +14,15 @@ table inet filter {
 "
 
 $NFT -f - <<< "$EXPECTED"
+
+EXPECTED="define ip-block-4 = { 1.1.1.1 }
+
+     create set inet filter ip-block-4-test {
+            type ipv4_addr
+            flags interval
+            auto-merge
+            elements = \$ip-block-4
+     }
+"
+
+$NFT -f - <<< "$EXPECTED"

diff --git a/tests/shell/testcases/sets/dumps/0049set_define_0.nft b/tests/shell/testcases/sets/dumps/0049set_define_0.nft
index 998b387a81511ca255acc4af154771a3d24f17da..d654420c00a1d1393004e660bbf26e0aa9e05cca 100644 (file)
--- a/tests/shell/testcases/sets/dumps/0049set_define_0.nft
+++ b/tests/shell/testcases/sets/dumps/0049set_define_0.nft
@@ -1,4 +1,11 @@
 table inet filter {
+       set ip-block-4-test {
+               type ipv4_addr
+               flags interval
+               auto-merge
+               elements = { 1.1.1.1 }
+       }
+
        chain input {
                type filter hook input priority filter; policy drop;
                tcp dport { 22, 80, 443 } ct state new counter packets 0 bytes 0 accept