* [nftables] bug: prefix masks applied to set lookup keys are decompiled as a prefix length applied to the set
@ 2020-01-05 0:41 Florian Zumbiehl
0 siblings, 0 replies; only message in thread
From: Florian Zumbiehl @ 2020-01-05 0:41 UTC (permalink / raw)
To: netfilter-devel
Hi,
I stumbled upon another bug in the Debian buster backports version of nftables:
| # nft 'table ip foobartest { chain c { ip saddr & 0.0.0.0 { 0.0.0.0 }; }; }'
| # nft list table ip foobartest
| table ip foobartest {
| chain c {
| ip saddr { 0.0.0.0 }/0
| }
| }
That prefix length suffix after the set both looks a bit strange and
doesn't seem to be valid nft input syntax, so I guess that makes it a bug?
My guess is that the cause is the second case in
relational_binop_postprocess(), which doesn't seem to check for the type of
the right operand?
Regards, Florian
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-01-05 0:41 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-05 0:41 [nftables] bug: prefix masks applied to set lookup keys are decompiled as a prefix length applied to the set Florian Zumbiehl
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).