]> git.ipfire.org Git - thirdparty/nftables.git/commit
evaluate: only allow stateful statements in set and map definitions
authorFlorian Westphal <fw@strlen.de>
Mon, 31 Mar 2025 15:23:20 +0000 (17:23 +0200)
committerFlorian Westphal <fw@strlen.de>
Mon, 31 Mar 2025 18:50:12 +0000 (20:50 +0200)
commit0acd81559ec9efe2cc3d869bfc8e5a0b4d888456
tree83222b57d17be06ff7d5b95db7b3a48289ff87ce
parent36bd6d0088bca1087aeccfe14aaa786200d755bc
evaluate: only allow stateful statements in set and map definitions

The bison parser doesn't allow this to happen due to grammar
restrictions, but the json input has no such issues.

The bogon input assigns 'notrack' which triggers:
BUG: unknown stateful statement type 19
nft: src/netlink_linearize.c:1061: netlink_gen_stmt_stateful: Assertion `0' failed.

After patch, we get:
Error: map statement must be stateful

Fixes: 07958ec53830 ("json: add set statement list support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
src/evaluate.c
tests/shell/testcases/bogons/nft-j-f/unkown_stateful_statement_type_19_assert [new file with mode: 0644]