[PATCH nft] evaluate: refuse to merge set and map

[PATCH nft] evaluate: refuse to merge set and map

[Florian Westphal]

Reject maps and sets of the same name:
 BUG: invalid range expression type catch-all set element
 nft: src/expression.c:1704: range_expr_value_low: Assertion `0' failed.

After:
8:6-6: Error: Cannot merge set with existing map of same name
  set z {
      ^

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/evaluate.c                                 | 11 +++++++++--
 ...xpression_type_catch-all_set_element_assert | 18 ++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 tests/shell/testcases/bogons/nft-f/invalid_range_expression_type_catch-all_set_element_assert

diff --git a/src/evaluate.c b/src/evaluate.c
index c666705b23be..709580c2fffe 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -5273,8 +5273,15 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set)
 		return 0;
 	}
 
-	if (existing_set && set_is_interval(set->flags) && !set_is_interval(existing_set->flags))
-		return set_error(ctx, set, "existing %s lacks interval flag", type);
+
+	if (existing_set) {
+		if (set_is_interval(set->flags) && !set_is_interval(existing_set->flags))
+			return set_error(ctx, set,
+					 "existing %s lacks interval flag", type);
+		if (set_is_map(existing_set->flags) != set_is_map(set->flags))
+			return set_error(ctx, set, "Cannot merge %s with existing %s of same name",
+					type, set_is_map(existing_set->flags) ? "map" : "set");
+	}
 
 	set->existing_set = existing_set;
 
diff --git a/tests/shell/testcases/bogons/nft-f/invalid_range_expression_type_catch-all_set_element_assert b/tests/shell/testcases/bogons/nft-f/invalid_range_expression_type_catch-all_set_element_assert
new file mode 100644
index 000000000000..3660ac3fda9c
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-f/invalid_range_expression_type_catch-all_set_element_assert
@@ -0,0 +1,18 @@
+table ip x {
+	map z {
+		type ipv4_addr : ipv4_addr
+		flags interval
+		elements = { 10.0.0.2, * : 192.168.0.4 }
+	}
+
+	set z {
+		type ipv4_addr
+		flags interval
+		counter
+		elements = { 1.1.1.0/24 counter packets 0 bytes 0,
+			 * counter packets 0 bytes 0packets 0 bytes ipv4_addr }
+		flags interval
+		auto-merge
+		elements = { 1.1.1.1 }
+	}
+}
-- 
2.49.0

Re: [PATCH nft] evaluate: refuse to merge set and map

[Pablo Neira Ayuso]

Hi Florian,

On Mon, Jun 23, 2025 at 03:22:13PM +0200, Florian Westphal wrote:
> Reject maps and sets of the same name:
>  BUG: invalid range expression type catch-all set element
>  nft: src/expression.c:1704: range_expr_value_low: Assertion `0' failed.
> 
> After:
> 8:6-6: Error: Cannot merge set with existing map of same name
>   set z {
>       ^
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  src/evaluate.c                                 | 11 +++++++++--
>  ...xpression_type_catch-all_set_element_assert | 18 ++++++++++++++++++
>  2 files changed, 27 insertions(+), 2 deletions(-)
>  create mode 100644 tests/shell/testcases/bogons/nft-f/invalid_range_expression_type_catch-all_set_element_assert
> 
> diff --git a/src/evaluate.c b/src/evaluate.c
> index c666705b23be..709580c2fffe 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -5273,8 +5273,15 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set)
>  		return 0;
>  	}
>  
> -	if (existing_set && set_is_interval(set->flags) && !set_is_interval(existing_set->flags))
> -		return set_error(ctx, set, "existing %s lacks interval flag", type);
> +
> +	if (existing_set) {
> +		if (set_is_interval(set->flags) && !set_is_interval(existing_set->flags))
> +			return set_error(ctx, set,
> +					 "existing %s lacks interval flag", type);
> +		if (set_is_map(existing_set->flags) != set_is_map(set->flags))

this helper is a bit confusing, it is hiding two type of maps:

static inline bool set_is_map(uint32_t set_flags)
{
        return set_is_datamap(set_flags) || set_is_objmap(set_flags);
}

then, I'd suggest

		if (set_is_datamap(existing_set->flags) != set_is_datamap(set->flags))
                        ...
		if (set_is_objmap(existing_set->flags) != set_is_objmap(set->flags))
                        ...

Thanks.

> +			return set_error(ctx, set, "Cannot merge %s with existing %s of same name",
> +					type, set_is_map(existing_set->flags) ? "map" : "set");
> +	}
>  
>  	set->existing_set = existing_set;
>  
> diff --git a/tests/shell/testcases/bogons/nft-f/invalid_range_expression_type_catch-all_set_element_assert b/tests/shell/testcases/bogons/nft-f/invalid_range_expression_type_catch-all_set_element_assert
> new file mode 100644
> index 000000000000..3660ac3fda9c
> --- /dev/null
> +++ b/tests/shell/testcases/bogons/nft-f/invalid_range_expression_type_catch-all_set_element_assert
> @@ -0,0 +1,18 @@
> +table ip x {
> +	map z {
> +		type ipv4_addr : ipv4_addr
> +		flags interval
> +		elements = { 10.0.0.2, * : 192.168.0.4 }
> +	}
> +
> +	set z {
> +		type ipv4_addr
> +		flags interval
> +		counter
> +		elements = { 1.1.1.0/24 counter packets 0 bytes 0,
> +			 * counter packets 0 bytes 0packets 0 bytes ipv4_addr }
> +		flags interval
> +		auto-merge
> +		elements = { 1.1.1.1 }
> +	}
> +}
> -- 
> 2.49.0
> 
> 

Re: [PATCH nft] evaluate: refuse to merge set and map

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> static inline bool set_is_map(uint32_t set_flags)
> {
>         return set_is_datamap(set_flags) || set_is_objmap(set_flags);
> }
> 
> then, I'd suggest
> 
> 		if (set_is_datamap(existing_set->flags) != set_is_datamap(set->flags))
>                         ...
> 		if (set_is_objmap(existing_set->flags) != set_is_objmap(set->flags))
>                         ...
> 
> Thanks.

Right, I sent a v2 that checks both map flavours.