diff options
author | Thomas Woerner <twoerner@redhat.com> | 2015-07-21 15:45:42 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-07-23 16:55:14 +0200 |
commit | 34344db9878ed53b387180362b1be77001e03e45 (patch) | |
tree | 6cae33d08917fd7b6efaf441dadfc7291c71b234 /iptables | |
parent | 8e1522698a7495002e5154f5643abb68e9c3a89a (diff) |
iptables-compat: Increase rule number only for the selected table and chain
This patch fixes the rule number handling in nft_rule_find and __nft_rule_list.
The rule number is only valid in the selected table and chain and therefore may
not be increased for other tables or chains.
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables')
-rw-r--r-- | iptables/nft.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index fb6ef919..183f17ca 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1746,17 +1746,17 @@ nft_rule_find(struct nft_handle *h, struct nft_rule_list *list, if (rulenum >= 0) { /* Delete by rule number case */ - if (rule_ctr != rulenum) - goto next; - found = true; - break; + if (rule_ctr == rulenum) { + found = true; + break; + } } else { found = h->ops->rule_find(h->ops, r, data); if (found) break; } -next: rule_ctr++; +next: r = nft_rule_list_iter_next(iter); } @@ -1966,12 +1966,12 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table, const char *rule_chain = nft_rule_attr_get_str(r, NFT_RULE_ATTR_CHAIN); - rule_ctr++; - if (strcmp(table, rule_table) != 0 || strcmp(chain, rule_chain) != 0) goto next; + rule_ctr++; + if (rulenum > 0 && rule_ctr != rulenum) { /* List by rule number case */ goto next; |