[PATCH nft] evaluate: merge nested set flags

[PATCH nft] evaluate: merge nested set flags

[Pablo Neira Ayuso]

A set may contain a nested set element definition, merge the nested set
flags so we don't hit:

 BUG: invalid data expression type range
 nft: netlink.c:400: netlink_gen_data: Assertion `0' failed.
 Aborted

With the following example ruleset:

 define dnat_ports      = { 1234-1567 }
 define port_allow      = {
        53,             # dns
        $dnat_ports,    # dnat
 }

 add rule x y tcp dport $port_allow accept

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1145
Fixes: a6b75b837f5e ("evaluate: set: Allow for set elems to be sets")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/evaluate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/evaluate.c b/src/evaluate.c
index 04367cedc62e..736ee1b0ee21 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1150,6 +1150,7 @@ static int expr_evaluate_set(struct eval_ctx *ctx, struct expr **expr)
 		    i->key->ops->type == EXPR_SET) {
 			struct expr *new = expr_clone(i->key);
 
+			set->set_flags |= i->key->set_flags;
 			list_replace(&i->list, &new->list);
 			expr_free(i);
 			i = new;
-- 
2.1.4