diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-02-19 00:15:13 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-02-22 19:59:45 +0100 |
| commit | 6c8db125b258da070313f20cdf9bc4124bba5383 (patch) | |
| tree | 9657a507f1616c0da51683ecc5b9e759ae88a5a7 /iptables/nft-ipv4.c | |
| parent | 0e067c7142c73404eb9ba6e355a28a92bf493675 (diff) | |
iptables-compat: unset context flags in netlink delinearize step
Once the data that the compare expression provides have been digested.
For example:
-A INPUT -i noexist -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT
doesn't show anymore the following broken output via iptables-compat-save:
-A INPUT -i
+t -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT
Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Diffstat (limited to 'iptables/nft-ipv4.c')
| -rw-r--r-- | iptables/nft-ipv4.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index ed309207..140093cd 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -123,6 +123,8 @@ static void get_frag(struct nft_xt_ctx *ctx, struct nft_rule_expr *e, bool *inv) *inv = true; else *inv = false; + + ctx->flags &= ~NFT_XT_CTX_BITWISE; } static const char *mask_to_str(uint32_t mask) @@ -178,10 +180,12 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx, case offsetof(struct iphdr, saddr): get_cmp_data(e, &addr, sizeof(addr), &inv); cs->fw.ip.src.s_addr = addr.s_addr; - if (ctx->flags & NFT_XT_CTX_BITWISE) + if (ctx->flags & NFT_XT_CTX_BITWISE) { parse_mask_ipv4(ctx, &cs->fw.ip.smsk); - else + ctx->flags &= ~NFT_XT_CTX_BITWISE; + } else { cs->fw.ip.smsk.s_addr = 0xffffffff; + } if (inv) cs->fw.ip.invflags |= IPT_INV_SRCIP; @@ -189,10 +193,12 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx, case offsetof(struct iphdr, daddr): get_cmp_data(e, &addr, sizeof(addr), &inv); cs->fw.ip.dst.s_addr = addr.s_addr; - if (ctx->flags & NFT_XT_CTX_BITWISE) + if (ctx->flags & NFT_XT_CTX_BITWISE) { parse_mask_ipv4(ctx, &cs->fw.ip.dmsk); - else + ctx->flags &= ~NFT_XT_CTX_BITWISE; + } else { cs->fw.ip.dmsk.s_addr = 0xffffffff; + } if (inv) cs->fw.ip.invflags |= IPT_INV_DSTIP; |