Re: [PATCH nft] evaluate: tolerate empty concatenation

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 860 bytes --]

On Thu, Mar 27, 2025 at 04:33:59PM +0100, Pablo Neira Ayuso wrote:
> Hi Florian,
> 
> On Mon, Mar 24, 2025 at 12:52:58PM +0100, Florian Westphal wrote:
> > Don't rely on a successful evaluation of set->key.
> > With this input, set->key fails validation but subsequent
> > element evaluation asserts because the context points at
> > the set key -- an empty concatenation.
> > 
> > Causes:
> > nft: src/evaluate.c:1681: expr_evaluate_concat: Assertion `!list_empty(&ctx->ectx.key->expressions)' failed.
> > 
> > After patch:
> > internal:0:0-0: Error: unqualified type  specified in set definition. Try "typeof expression" instead of "type datatype".
> > internal:0:0-0: Error: Could not parse symbolic invalid expression
> 
> Maybe block this from the json parser itself?

Maybe this instead? This covers for empty concatenation in both set
key and set data.

[-- Attachment #2: x.patch --]
[-- Type: text/x-diff, Size: 752 bytes --]

commit e0123be7a908d1a4b7c43d0817b9ecccf2bd1416
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Thu Mar 27 16:32:16 2025 +0100

    parser_json: reject empty concatention in set key and data
    
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/parser_json.c b/src/parser_json.c
index 17bc38b565ae..513e0b10f028 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -1729,6 +1729,13 @@ static struct expr *json_parse_dtype_expr(struct json_ctx *ctx, json_t *root)
 			}
 			compound_expr_add(expr, i);
 		}
+
+		if (list_empty(&expr->expressions)) {
+			json_error(ctx, "Empty concatenation");
+			expr_free(expr);
+			return NULL;
+		}
+
 		return expr;
 	} else if (json_is_object(root)) {
 		const char *key;