diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-06-01 21:14:47 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-12-30 23:50:31 +0100 |
| commit | d801b9f3b8161752ea2358a0bfb614603d28a8e5 (patch) | |
| tree | 70a09ef09cc6206a13274414aeabd3db55d0e6f3 /iptables/nft-shared.c | |
| parent | f041efe3c26e3059df1ac8f1775f77423d4be5f6 (diff) | |
xtables: fix -p protocol
The protocol field in both IPv4 and IPv6 headers are 8 bits long,
so we have to compare 8 bits.
Reported-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft-shared.c')
| -rw-r--r-- | iptables/nft-shared.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c index c368f40b..c0ee4c8a 100644 --- a/iptables/nft-shared.c +++ b/iptables/nft-shared.c @@ -91,6 +91,11 @@ void add_cmp_ptr(struct nft_rule *r, uint32_t op, void *data, size_t len) nft_rule_add_expr(r, expr); } +void add_cmp_u8(struct nft_rule *r, uint8_t val, uint32_t op) +{ + add_cmp_ptr(r, op, &val, sizeof(val)); +} + void add_cmp_u16(struct nft_rule *r, uint16_t val, uint32_t op) { add_cmp_ptr(r, op, &val, sizeof(val)); @@ -159,7 +164,7 @@ void add_addr(struct nft_rule *r, int offset, } void add_proto(struct nft_rule *r, int offset, size_t len, - uint32_t proto, int invflags) + uint8_t proto, int invflags) { uint32_t op; @@ -170,7 +175,7 @@ void add_proto(struct nft_rule *r, int offset, size_t len, else op = NFT_CMP_EQ; - add_cmp_u32(r, proto, op); + add_cmp_u8(r, proto, op); } bool is_same_interfaces(const char *a_iniface, const char *a_outiface, |