diff options
author | Shivani Bhardwaj <shivanib134@gmail.com> | 2016-04-14 20:55:58 +0530 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-04-27 19:16:58 +0200 |
commit | d1555a0906e35ba8d170613d5a43da64e527dbe1 (patch) | |
tree | 090c4ea871c8a04ec5f3191b6688e1c4d7fa0b43 /extensions/libxt_NFQUEUE.c | |
parent | 8bba88809664abe72b8e1b8520584235ae156eb2 (diff) |
extensions: libxt_NFQUEUE: Fix bug with order of fanout and bypass
NFQUEUE had a bug with the ordering of fanout and bypass options which
was arising due to same and odd values for flags and bypass when used
together. Because of this, during bitwise ANDing of flags and
NFQ_FLAG_CPU_FANOUT, the value always evaluated to false (since
NFQ_FLAG_CPU_FANOUT=0x02) and led to skipping of fanout option
whenever it was used before bypass because then flags would be 1.
Before this patch,
$ sudo iptables -A FORWARD -j NFQUEUE -p TCP --sport 80 --queue-balance 0:3 --queue-cpu-fanout --queue-bypass
Chain FORWARD (policy ACCEPT)
target prot opt source destination
NFQUEUE tcp -- anywhere anywhere tcp spt:http NFQUEUE balance 0:3 bypass
After this patch,
Chain FORWARD (policy ACCEPT)
target prot opt source destination
NFQUEUE tcp -- anywhere anywhere tcp spt:http NFQUEUE balance 0:3 bypass cpu-fanout
Closes bugzilla entry: http://bugzilla.netfilter.org/show_bug.cgi?id=939
Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_NFQUEUE.c')
-rw-r--r-- | extensions/libxt_NFQUEUE.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/extensions/libxt_NFQUEUE.c b/extensions/libxt_NFQUEUE.c index 81154574..0b5becc2 100644 --- a/extensions/libxt_NFQUEUE.c +++ b/extensions/libxt_NFQUEUE.c @@ -99,7 +99,7 @@ static void NFQUEUE_parse_v2(struct xt_option_call *cb) NFQUEUE_parse_v1(cb); switch (cb->entry->id) { case O_QUEUE_BYPASS: - info->bypass = 1; + info->bypass |= NFQ_FLAG_BYPASS; break; } } |