Netfilter-Devel Archive on
 help / color / Atom feed
From: Pablo Neira Ayuso <>
Subject: [PATCH nft] evaluate: disregard ct address matching without family
Date: Fri, 31 Jul 2020 20:22:49 +0200
Message-ID: <> (raw)

The following rule:

 # nft add rule ip x y ct original daddr @servers

breaks with:

 # nft list ruleset
nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed > 0' failed.

Bail out if this syntax is used, instead users should rely on:

 # nft add rule ip x y ct original ip daddr @servers

which uses NFT_CT_{SRC,DST}_{IP,IP6} in the bytecode generation.

This issue is described in 7f742d0a9071 ("ct: support for

Signed-off-by: Pablo Neira Ayuso <>
 src/evaluate.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/evaluate.c b/src/evaluate.c
index a99b11437342..b64ed3c0c6a4 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1907,6 +1907,12 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
 			/* fall through */
 		case EXPR_SET_REF:
+			if (rel->left->etype == EXPR_CT &&
+			    (rel->left->ct.key == NFT_CT_SRC ||
+			     rel->left->ct.key == NFT_CT_DST))
+				return expr_error(ctx->msgs, left,
+						  "specify either ip or ip6 for address matching");
 			/* Data for range lookups needs to be in big endian order */
 			if (right->set->flags & NFT_SET_INTERVAL &&
 			    byteorder_conversion(ctx, &rel->left, BYTEORDER_BIG_ENDIAN) < 0)

                 reply index

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Netfilter-Devel Archive on

Archives are clonable:
	git clone --mirror netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ \
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone