diff options
| author | Phil Sutter <phil@nwl.cc> | 2023-09-06 16:32:47 +0200 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2023-09-14 12:20:11 +0200 |
| commit | 52ed0ac516db9f3a44f61dfd8b65d20631bfa95b (patch) | |
| tree | 0e04e0726ae98f0ac68d6801737149fabb7decb3 /iptables/nft-shared.h | |
| parent | ea12b1d2b191f100a6fdb83af4681364e4dba12a (diff) | |
nft: Fix for useless meta expressions in rule
A relict of legacy iptables' mandatory matching on interfaces and IP
addresses is support for the '-i +' notation, basically a "match any
input interface". Trying to make things better than its predecessor,
iptables-nft boldly optimizes that nop away - not entirely though, the
meta expression loading the interface name was left in place. While not
a problem (apart from pointless overhead) in current HEAD, v1.8.7 would
trip over this as a following cmp expression (for another match) was
incorrectly linked to that stale meta expression, loading strange values
into the respective interface name field.
While being at it, merge and generalize the functions into a common one
for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too.
Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name")
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'iptables/nft-shared.h')
| -rw-r--r-- | iptables/nft-shared.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h index 4f47058d..51d1e460 100644 --- a/iptables/nft-shared.h +++ b/iptables/nft-shared.h @@ -95,8 +95,8 @@ void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len, uint void add_cmp_u8(struct nftnl_rule *r, uint8_t val, uint32_t op, uint8_t sreg); void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op, uint8_t sreg); void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg); -void add_iniface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op); -void add_outiface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op); +void add_iface(struct nft_handle *h, struct nftnl_rule *r, + char *iface, uint32_t key, uint32_t op); void add_addr(struct nft_handle *h, struct nftnl_rule *r, enum nft_payload_bases base, int offset, void *data, void *mask, size_t len, uint32_t op); void add_proto(struct nft_handle *h, struct nftnl_rule *r, int offset, size_t len, |