diff options
| author | Phil Sutter <phil@nwl.cc> | 2016-11-29 12:47:25 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-11-29 23:03:51 +0100 |
| commit | 6de5f08a33fc4503b7199cece736979b4be91ef3 (patch) | |
| tree | fee8a274d9bc8a1b26c8050bcb8218ffc89e92e4 /extensions | |
| parent | 92a3d0898d6a046cfc8c90757bdc08094413c79e (diff) | |
tcp_xlate: Enclose LH flag values in parentheses
This fixes TCP flags matches:
| $ iptables-translate -A invalid -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
| nft add rule ip filter invalid tcp flags & fin|syn == fin|syn counter drop
Although the generated rule is syntactically correct and accepted by
nft, it will be interpreted in a different way than expected since
binary AND takes precedence over OR.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions')
| -rw-r--r-- | extensions/libxt_tcp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c index 7f68b812..58f3c0a0 100644 --- a/extensions/libxt_tcp.c +++ b/extensions/libxt_tcp.c @@ -435,9 +435,9 @@ static int tcp_xlate(struct xt_xlate *xl, return 0; if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { - xt_xlate_add(xl, "%stcp flags & ", space); + xt_xlate_add(xl, "%stcp flags & (", space); print_tcp_xlate(xl, tcpinfo->flg_mask); - xt_xlate_add(xl, " %s ", + xt_xlate_add(xl, ") %s ", tcpinfo->invflags & XT_TCP_INV_FLAGS ? "!=": "=="); print_tcp_xlate(xl, tcpinfo->flg_cmp); } |