evaluate: auto-merge is only available for singleton interval sets

auto-merge is only available to interval sets with one value only,
untoggle this flag for concatenation with intervals.

Later, this can be hardened to reject it.

Fixes: 30f667920601 ("src: add 'auto-merge' option to sets")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 3cf58d85e41466b95ebdb525b611cf48b3270a38..ddc46754fc675556b73c34a22aab6a37dc0bdf13 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -5041,6 +5041,9 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set)
                       sizeof(set->desc.field_len));
                set->desc.field_count = set->key->field_count;
                set->flags |= NFT_SET_CONCAT;
+
+               if (set->automerge)
+                       set->automerge = false;
        }
 
        if (set_is_anonymous(set->flags) && set->key->etype == EXPR_CONCAT) {