evaluate: don't allow nat map with specified protocol

commit 43cf4a2973ee9e3ab20edce47c6a054485707592 upstream.

Included bogon asserts:
src/netlink_linearize.c:1305: netlink_gen_nat_stmt: Assertion `stmt->nat.proto == NULL' failed.

The comment right above the assertion says:
  nat_stmt evaluation step doesn't allow
  STMT_NAT_F_CONCAT && stmt->nat.proto.

... except it does allow it.  Disable this.

Fixes: c68314dd4263 ("src: infer NAT mapping with concatenation from set")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 9585991f5ff178c013b22d8344be5c15e24c419c..da7ee883691aaa2d05f4de05523bd255634eaf4e 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3851,6 +3851,10 @@ static int stmt_evaluate_nat_map(struct eval_ctx *ctx, struct stmt *stmt)
        int addr_type;
        int err;
 
+       if (stmt->nat.proto)
+               return stmt_binary_error(ctx, stmt, stmt->nat.proto,
+                                 "nat map and protocol are mutually exclusive");
+
        if (stmt->nat.family == NFPROTO_INET)
                expr_family_infer(pctx, stmt->nat.addr, &stmt->nat.family);
 

diff --git a/tests/shell/testcases/bogons/nat_map_and_protocol_assert b/tests/shell/testcases/bogons/nat_map_and_protocol_assert
new file mode 100644 (file)
index 0000000..67f2ae8
--- /dev/null
+++ b/tests/shell/testcases/bogons/nat_map_and_protocol_assert
@@ -0,0 +1,5 @@
+table t {
+ chain y {
+  snat to ip saddr . tcp sport map { 1.1.1.1 . 1 : 1.1.1.2 . 1 } : 6
+ }
+}