Re: [nft PATCH v2 3/3] evaluate: Fix for 'meta hour' ranges spanning date boundaries

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Phil,

On Tue, Jul 29, 2025 at 06:18:32PM +0200, Phil Sutter wrote:
> @@ -2772,12 +2780,15 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
>  
>  	pctx = eval_proto_ctx(ctx);
>  
> -	if (rel->right->etype == EXPR_RANGE && lhs_is_meta_hour(rel->left)) {
> -		ret = __expr_evaluate_range(ctx, &rel->right);
> +	if (lhs_is_meta_hour(rel->left) &&
> +	    rel->right->etype == EXPR_RANGE_SYMBOL) {

I just realised that we cannot just replace one expression type by
another.

For relational, this needs to handle EXPR_RANGE too, because this
generates a range expression, for instance:

define end="14:00"

table ip x {
        chain y {
                meta hour "13:00"-$end
        }
}

this code is a bit special, it happens before the range evaluation.
For relational expressions, this is translated to EXPR_RANGE. Only
sets are using EXPR_RANGE_VALUE, relational expressions still use
EXPR_RANGE.

So this special case can see either EXPR_RANGE and EXPR_RANGE_SYMBOL.

> +		range = symbol_range_expand(rel->right);

Then, this conversion above only need to happen for EXPR_RANGE_SYMBOL.

> +		ret = __expr_evaluate_range(ctx, &range);
>  		if (ret)
>  			return ret;
>  
> -		range = rel->right;
> +		expr_free(rel->right);
> +		rel->right = range;
>  
>  		/*
>  		 * We may need to do this for proper cross-day ranges,