[Bug 1715] New: __netlink_gen_concat_key assertion raised by attempt to expand set-defining variable as a set key

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1715

            Bug ID: 1715
           Summary: __netlink_gen_concat_key assertion raised by attempt
                    to expand set-defining variable as a set key
           Product: nftables
           Version: 1.0.x
          Hardware: x86_64
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: kfm at plushkava.net

Consider the following ruleset.

define ext_if = { "eth0", "eth1" }
table ip filter {
    chain c {
        iifname . tcp dport { $ext_if . 22 } accept
    }
}

Attempting to load this ruleset results in SIGABRT.

BUG: invalid expression type 'set' in setnft: netlink.c:304:
__netlink_gen_concat_key: Assertion `0' failed.
Aborted (core dumped)

I presume that this is a consequence of ntables not knowing how to treat such a
variable, which implies the generation of multiple elements. Ideally, nftables
would be able to handle this and commpose the set as { "eth0" . 22, "eth1" . 22
}. Otherwise, it should instead print an informative diagnostic message and
exit, rather than die to a signal.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20231025/789a432c/attachment.html>