Re: [PATCH nftables] rule: check address family in set collapse

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Sep 01, 2022 at 10:10:41AM -0600, Derek Hageman wrote:
> 498a5f0c added collapsing of set operations in different commands.
> However, the logic is currently too relaxed.  It is valid to have a
> table and set with identical names on different address families.
> For example:
> 
>   table ip a {
>     set x {
>       type inet_service;
>     }
>   }
>   table ip6 a {
>       set x {
>         type inet_service;
>       }
>   }
>   add element ip a x { 1 }
>   add element ip a x { 2 }
>   add element ip6 a x { 2 }
> 
> The above currently results in nothing being added to the ip6 family
> table due to being collapsed into the ip table add.  Prior to 498a5f0c
> the set add would work.  The fix is simply to check the family in
> addition to the table and set names before allowing a collapse.

Applied, thanks.



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux