[PATCH nft] evaluate: maps: check element data mapping matches set data definition

[PATCH nft] evaluate: maps: check element data mapping matches set data definition

[Florian Westphal]

This change is similar to
7f4d7fef31bd ("evaluate: check element key vs. set definition")

but this time for data mappings.

The included bogon asserts with:
BUG: invalid data expression type catch-all set element
nft: src/netlink.c:596: __netlink_gen_data: Assertion `0' failed.

after:
internal:0:0-0: Error: Element mapping mismatches map definition, expected packet mark, not 'invalid'

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/evaluate.c                                | 20 +++++++++++
 .../nft-j-f/catchall_as_data_element_assert   | 34 +++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert

diff --git a/src/evaluate.c b/src/evaluate.c
index f7e97ef7ea10..c20a1d526c1e 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2361,6 +2361,20 @@ static bool data_mapping_has_interval(struct expr *data)
 	return false;
 }
 
+static bool elem_data_compatible(const struct expr *set_data,
+				const struct expr *elem_data)
+{
+	if (elem_data->etype == EXPR_RANGE) {
+		/* EXPR_RANGE has invalid_type, use the lhs type.
+		 * It should be impossible to have a EXPR_RANGE where
+		 * lhs and rhs don't have the same dtype.
+		 */
+		return elem_data_compatible(set_data, elem_data->left);
+	}
+
+	return datatype_compatible(set_data->dtype, elem_data->dtype);
+}
+
 static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr)
 {
 	struct expr *mapping = *expr;
@@ -2417,6 +2431,12 @@ static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr)
 				  "Object mapping data should be a value, not %s",
 				  expr_name(mapping->right));
 
+	if (set_is_datamap(set->flags) &&
+	    !elem_data_compatible(set->data, mapping->right))
+		return expr_error(ctx->msgs, mapping->right,
+				  "Element mapping mismatches map definition, expected %s, not '%s'",
+				  set->data->dtype->desc, mapping->right->dtype->desc);
+
 	mapping->flags |= EXPR_F_CONSTANT;
 	return 0;
 }
diff --git a/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert b/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert
new file mode 100644
index 000000000000..5b224f9bdcbf
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert
@@ -0,0 +1,34 @@
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "1.1.1",
+        "release_name": "Commodore Bullmoose #2",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "t",
+        "handle": 1
+      }
+    },
+    {
+      "map": {
+        "family": "ip",
+        "name": "m",
+        "table": "t",
+        "type": "ipv4_addr",
+        "handle": 1,
+        "map": "mark",
+        "elem": [
+          [
+            "1.2.3.4",
+            "*"
+          ]
+        ]
+      }
+    }
+  ]
+}
-- 
2.49.1

Re: [PATCH nft] evaluate: maps: check element data mapping matches set data definition

[Pablo Neira Ayuso]

On Mon, Jul 21, 2025 at 12:57:07PM +0200, Florian Westphal wrote:
> This change is similar to
> 7f4d7fef31bd ("evaluate: check element key vs. set definition")
> 
> but this time for data mappings.
> 
> The included bogon asserts with:
> BUG: invalid data expression type catch-all set element
> nft: src/netlink.c:596: __netlink_gen_data: Assertion `0' failed.
> 
> after:
> internal:0:0-0: Error: Element mapping mismatches map definition, expected packet mark, not 'invalid'
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>

Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>