Re: [PATCH nft] evaluate: bogus error when refering to existing non-base chain

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Jul 16, 2019 at 01:51:20PM +0200, Pablo Neira Ayuso wrote:
>  add rule ip testNEW test6 jump test8
>                                 ^^^^^
>  Error: invalid verdict chain expression value

Note that I can't reproduce this issue locally.

[...]
> -			if ((stmt->expr->chain->etype != EXPR_SYMBOL &&
> -			    stmt->expr->chain->etype != EXPR_VALUE) ||
> -			    stmt->expr->chain->symtype != SYMBOL_VALUE) {
> -				return stmt_error(ctx, stmt,
> -						  "invalid verdict chain expression %s\n",
> -						  expr_name(stmt->expr->chain));
> -			}

So I guess the problem is that for an etype of EXPR_VALUE, symtype is
still checked. The latter is used by EXPR_SYMBOL only, but since
SYMBOL_VALUE is 0 (implicitly, it's the first item in enum
symbol_types) this probably works by accident.

I still don't understand why it doesn't work for you, but I guess the
bug is found. So probably

| if ((stmt->expr->chain->etype != EXPR_SYMBOL ||
|       stmt->expr->chain->symtype != SYMBOL_VALUE) &&
|     stmt->expr->chain->etype != EXPR_VALUE)) {

is right.

Cheers, Phil



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux