This change is similar to 7f4d7fef31bd ("evaluate: check element key vs. set definition") but this time for data mappings. The included bogon asserts with: BUG: invalid data expression type catch-all set element nft: src/netlink.c:596: __netlink_gen_data: Assertion `0' failed. after: internal:0:0-0: Error: Element mapping mismatches map definition, expected packet mark, not 'invalid' Signed-off-by: Florian Westphal --- src/evaluate.c | 20 +++++++++++ .../nft-j-f/catchall_as_data_element_assert | 34 +++++++++++++++++++ 2 files changed, 54 insertions(+) create mode 100644 tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert diff --git a/src/evaluate.c b/src/evaluate.c index f7e97ef7ea10..c20a1d526c1e 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2361,6 +2361,20 @@ static bool data_mapping_has_interval(struct expr *data) return false; } +static bool elem_data_compatible(const struct expr *set_data, + const struct expr *elem_data) +{ + if (elem_data->etype == EXPR_RANGE) { + /* EXPR_RANGE has invalid_type, use the lhs type. + * It should be impossible to have a EXPR_RANGE where + * lhs and rhs don't have the same dtype. + */ + return elem_data_compatible(set_data, elem_data->left); + } + + return datatype_compatible(set_data->dtype, elem_data->dtype); +} + static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr) { struct expr *mapping = *expr; @@ -2417,6 +2431,12 @@ static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr) "Object mapping data should be a value, not %s", expr_name(mapping->right)); + if (set_is_datamap(set->flags) && + !elem_data_compatible(set->data, mapping->right)) + return expr_error(ctx->msgs, mapping->right, + "Element mapping mismatches map definition, expected %s, not '%s'", + set->data->dtype->desc, mapping->right->dtype->desc); + mapping->flags |= EXPR_F_CONSTANT; return 0; } diff --git a/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert b/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert new file mode 100644 index 000000000000..5b224f9bdcbf --- /dev/null +++ b/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert @@ -0,0 +1,34 @@ +{ + "nftables": [ + { + "metainfo": { + "version": "1.1.1", + "release_name": "Commodore Bullmoose #2", + "json_schema_version": 1 + } + }, + { + "table": { + "family": "ip", + "name": "t", + "handle": 1 + } + }, + { + "map": { + "family": "ip", + "name": "m", + "table": "t", + "type": "ipv4_addr", + "handle": 1, + "map": "mark", + "elem": [ + [ + "1.2.3.4", + "*" + ] + ] + } + } + ] +} -- 2.49.1