diff options
| author | Phil Sutter <phil@nwl.cc> | 2024-02-02 13:14:29 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2024-02-02 18:26:14 +0100 |
| commit | 4195a89ab2e2bd690ba255e40a5c3d309f031796 (patch) | |
| tree | 29afaaeb5482f454c10044510d4ea2591508000f | |
| parent | 9d400db20cf9f1c4a57c0791e563f22bafcd841a (diff) | |
nft: Do not omit full ranges if inverted
Otherwise this turns a never matching rule into an always matching one.
Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match")
Signed-off-by: Phil Sutter <phil@nwl.cc>
| -rw-r--r-- | extensions/libxt_tcp.t | 4 | ||||
| -rw-r--r-- | extensions/libxt_udp.t | 4 | ||||
| -rw-r--r-- | iptables/nft.c | 4 |
3 files changed, 6 insertions, 6 deletions
diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t index baa41615..911c5111 100644 --- a/extensions/libxt_tcp.t +++ b/extensions/libxt_tcp.t @@ -7,13 +7,13 @@ -p tcp -m tcp --sport 1024:65535;=;OK -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK -p tcp -m tcp --sport :;-p tcp -m tcp;OK --p tcp -m tcp ! --sport :;-p tcp -m tcp;OK;LEGACY;-p tcp +-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK -p tcp -m tcp --sport :4;-p tcp -m tcp --sport 0:4;OK -p tcp -m tcp --sport 4:;-p tcp -m tcp --sport 4:65535;OK -p tcp -m tcp --sport 4:4;-p tcp -m tcp --sport 4;OK -p tcp -m tcp --sport 4:3;;FAIL -p tcp -m tcp --dport :;-p tcp -m tcp;OK --p tcp -m tcp ! --dport :;-p tcp -m tcp;OK;LEGACY;-p tcp +-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK -p tcp -m tcp --dport :4;-p tcp -m tcp --dport 0:4;OK -p tcp -m tcp --dport 4:;-p tcp -m tcp --dport 4:65535;OK -p tcp -m tcp --dport 4:4;-p tcp -m tcp --dport 4;OK diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t index 09dff363..3c85b09f 100644 --- a/extensions/libxt_udp.t +++ b/extensions/libxt_udp.t @@ -7,13 +7,13 @@ -p udp -m udp --sport 1024:65535;=;OK -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK -p udp -m udp --sport :;-p udp -m udp;OK --p udp -m udp ! --sport :;-p udp -m udp;OK;LEGACY;-p udp +-p udp -m udp ! --sport :;-p udp -m udp;OK -p udp -m udp --sport :4;-p udp -m udp --sport 0:4;OK -p udp -m udp --sport 4:;-p udp -m udp --sport 4:65535;OK -p udp -m udp --sport 4:4;-p udp -m udp --sport 4;OK -p udp -m udp --sport 4:3;;FAIL -p udp -m udp --dport :;-p udp -m udp;OK --p udp -m udp ! --dport :;-p udp -m udp;OK;LEGACY;-p udp +-p udp -m udp ! --dport :;-p udp -m udp;OK -p udp -m udp --dport :4;-p udp -m udp --dport 0:4;OK -p udp -m udp --dport 4:;-p udp -m udp --dport 4:65535;OK -p udp -m udp --dport 4:4;-p udp -m udp --dport 4;OK diff --git a/iptables/nft.c b/iptables/nft.c index c2cbc9d7..dae6698d 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1324,7 +1324,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, return 0; } - if (src[0] || src[1] < 0xffff) { + if (src[0] || src[1] < UINT16_MAX || invert_src) { expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); if (!expr) return -ENOMEM; @@ -1335,7 +1335,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, return ret; } - if (dst[0] || dst[1] < 0xffff) { + if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); if (!expr) return -ENOMEM; |