* [PATCH nft] evaluate: element key cannot in map cannot be a set
@ 2021-08-11 10:33 Pablo Neira Ayuso
0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2021-08-11 10:33 UTC (permalink / raw)
To: netfilter-devel
# cat x.nft
define lala = { eth0, eth1 }
table ip x {
chain y {
iifname vmap { lo : accept, $lala : drop }
}
}
# nft -f x.nft
x.nft:5:16-44: Error: Could not process rule: Invalid argument
iifname vmap { lo : accept, $lala : drop }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
instead:
x.nft:1:15-28: Error: Element key in map cannot be a set
define lala = { eth0, eth1 }
^^^^^^^^^^^^^^
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
src/evaluate.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/src/evaluate.c b/src/evaluate.c
index 8b5f51cee01c..110a40413c1c 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1395,16 +1395,23 @@ static int expr_evaluate_set_elem(struct eval_ctx *ctx, struct expr **expr)
if (expr_evaluate(ctx, &elem->key) < 0)
return -1;
- if (ctx->set &&
- !(ctx->set->flags & (NFT_SET_ANONYMOUS | NFT_SET_INTERVAL))) {
- switch (elem->key->etype) {
- case EXPR_PREFIX:
- case EXPR_RANGE:
- return expr_error(ctx->msgs, elem,
- "You must add 'flags interval' to your %s declaration if you want to add %s elements",
- set_is_map(ctx->set->flags) ? "map" : "set", expr_name(elem->key));
- default:
- break;
+ if (ctx->set) {
+ if (!(ctx->set->flags & (NFT_SET_ANONYMOUS | NFT_SET_INTERVAL))) {
+ switch (elem->key->etype) {
+ case EXPR_PREFIX:
+ case EXPR_RANGE:
+ return expr_error(ctx->msgs, elem,
+ "You must add 'flags interval' to your %s declaration if you want to add %s elements",
+ set_is_map(ctx->set->flags) ? "map" : "set", expr_name(elem->key));
+ break;
+ default:
+ break;
+ }
+ }
+ if (set_is_map(ctx->set->flags) &&
+ elem->key->etype == EXPR_SET) {
+ return expr_error(ctx->msgs, elem->key,
+ "Element key in map cannot be a set");
}
}
--
2.20.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2021-08-11 10:33 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-08-11 10:33 [PATCH nft] evaluate: element key cannot in map cannot be a set Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).