summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2021-05-24 21:54:36 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2021-05-24 22:16:13 +0200
commit3b4f35eee51884f581223188a71f84ef782eb726 (patch)
tree64fe7fb4c0212bd1dd325e327989372ad2038dce
parentf92636da30ec96f45a2eeaac025714de968b586a (diff)
evaluate: allow == and != in the new shortcut syntax to match for flags
The flags / mask syntax only allows for ==, != and the implicit operation (which is == in this case). # nft add rule x y tcp flags ! syn / syn,ack Error: either == or != is allowed add rule x y tcp flags ! syn / syn,ack ^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--src/evaluate.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c
index 006b04af..384e2fa7 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2139,6 +2139,10 @@ static int expr_evaluate_flagcmp(struct eval_ctx *ctx, struct expr **exprp)
{
struct expr *expr = *exprp, *binop, *rel;
+ if (expr->op != OP_EQ &&
+ expr->op != OP_NEQ)
+ return expr_error(ctx->msgs, expr, "either == or != is allowed");
+
binop = binop_expr_alloc(&expr->location, OP_AND,
expr_get(expr->flagcmp.expr),
expr_get(expr->flagcmp.mask));