diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-05-24 21:54:36 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-05-24 22:16:13 +0200 |
commit | 3b4f35eee51884f581223188a71f84ef782eb726 (patch) | |
tree | 64fe7fb4c0212bd1dd325e327989372ad2038dce | |
parent | f92636da30ec96f45a2eeaac025714de968b586a (diff) |
evaluate: allow == and != in the new shortcut syntax to match for flags
The flags / mask syntax only allows for ==, != and the implicit
operation (which is == in this case).
# nft add rule x y tcp flags ! syn / syn,ack
Error: either == or != is allowed
add rule x y tcp flags ! syn / syn,ack
^^^^^^^^^^^^^^^^^^^^^^^^^
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r-- | src/evaluate.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 006b04af..384e2fa7 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2139,6 +2139,10 @@ static int expr_evaluate_flagcmp(struct eval_ctx *ctx, struct expr **exprp) { struct expr *expr = *exprp, *binop, *rel; + if (expr->op != OP_EQ && + expr->op != OP_NEQ) + return expr_error(ctx->msgs, expr, "either == or != is allowed"); + binop = binop_expr_alloc(&expr->location, OP_AND, expr_get(expr->flagcmp.expr), expr_get(expr->flagcmp.mask)); |