Re: [PATCH nft] evaluate: don't allow nat map with specified protocol

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Mar 20, 2025 at 09:39:20AM +0100, Florian Westphal wrote:
> Included bogon asserts:
> src/netlink_linearize.c:1305: netlink_gen_nat_stmt: Assertion `stmt->nat.proto == NULL' failed.
> 
> The comment right above the assertion says:
>   nat_stmt evaluation step doesn't allow
>   STMT_NAT_F_CONCAT && stmt->nat.proto.

Oops.

> ... except it does allow it.  Disable this.
> 
> Fixes: c68314dd4263 ("src: infer NAT mapping with concatenation from set")
> Signed-off-by: Florian Westphal <fw@strlen.de>

Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

Thanks.

> ---
>  src/evaluate.c                                           | 4 ++++
>  tests/shell/testcases/bogons/nat_map_and_protocol_assert | 5 +++++
>  2 files changed, 9 insertions(+)
>  create mode 100644 tests/shell/testcases/bogons/nat_map_and_protocol_assert
> 
> diff --git a/src/evaluate.c b/src/evaluate.c
> index 95b9b3d547d9..3a453d010538 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -4196,6 +4196,10 @@ static int stmt_evaluate_nat_map(struct eval_ctx *ctx, struct stmt *stmt)
>  	int addr_type;
>  	int err;
>  
> +	if (stmt->nat.proto)
> +		return stmt_binary_error(ctx, stmt, stmt->nat.proto,
> +				  "nat map and protocol are mutually exclusive");
> +
>  	if (stmt->nat.family == NFPROTO_INET)
>  		expr_family_infer(pctx, stmt->nat.addr, &stmt->nat.family);
>  
> diff --git a/tests/shell/testcases/bogons/nat_map_and_protocol_assert b/tests/shell/testcases/bogons/nat_map_and_protocol_assert
> new file mode 100644
> index 000000000000..67f2ae873cd1
> --- /dev/null
> +++ b/tests/shell/testcases/bogons/nat_map_and_protocol_assert
> @@ -0,0 +1,5 @@
> +table t {
> + chain y {
> +  snat to ip saddr . tcp sport map { 1.1.1.1 . 1 : 1.1.1.2 . 1 } : 6
> + }
> +}
> -- 
> 2.48.1
> 
>