summaryrefslogtreecommitdiffstats
path: root/extensions/libxt_ipcomp.c
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2016-11-29 12:47:25 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2016-11-29 23:03:51 +0100
commit6de5f08a33fc4503b7199cece736979b4be91ef3 (patch)
treefee8a274d9bc8a1b26c8050bcb8218ffc89e92e4 /extensions/libxt_ipcomp.c
parent92a3d0898d6a046cfc8c90757bdc08094413c79e (diff)
tcp_xlate: Enclose LH flag values in parentheses
This fixes TCP flags matches: | $ iptables-translate -A invalid -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP | nft add rule ip filter invalid tcp flags & fin|syn == fin|syn counter drop Although the generated rule is syntactically correct and accepted by nft, it will be interpreted in a different way than expected since binary AND takes precedence over OR. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_ipcomp.c')
0 files changed, 0 insertions, 0 deletions