diff options
| author | Florian Westphal <fw@strlen.de> | 2017-05-29 19:25:37 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2017-06-06 20:53:13 +0200 |
| commit | ae07c2361472b1852d886bf06ed9f2a1fd8aca38 (patch) | |
| tree | 53fed20aaf8de499a875f04213348b4ee5ef6b84 /src | |
| parent | 8786dc5f30db5a686c25de7cc80da1fd21082683 (diff) | |
meta: permit meta nfproto ip in ip family
works:
add rule ip filter input ct original saddr 1.2.3.4
(family ctx init initialises network base to proto_ip).
fails to parse 1.2.3.4 address:
add rule ip filter input meta nfproto ipv4 ct original saddr 1.2.3.4
... because meta_expr_pctx_update() won't find a dependency
from "ip" to "ip" and then overwrites the correct base with proto_unknown.
"meta nfproto ip" is useless in the ip family, as it will always match,
i.e. a better (but more compliated) fix would be to remove the statement
during evaluation.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/meta.c | 11 |
1 files changed, 9 insertions, 2 deletions
@@ -497,6 +497,7 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx, const struct hook_proto_desc *h = &hook_proto_desc[ctx->family]; const struct expr *left = expr->left, *right = expr->right; const struct proto_desc *desc; + uint8_t protonum; assert(expr->op == OP_EQ); @@ -514,10 +515,16 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx, proto_ctx_update(ctx, PROTO_BASE_LL_HDR, &expr->location, desc); break; case NFT_META_NFPROTO: - desc = proto_find_upper(h->desc, mpz_get_uint8(right->value)); - if (desc == NULL) + protonum = mpz_get_uint8(right->value); + desc = proto_find_upper(h->desc, protonum); + if (desc == NULL) { desc = &proto_unknown; + if (protonum == ctx->family && + h->base == PROTO_BASE_NETWORK_HDR) + desc = h->desc; + } + proto_ctx_update(ctx, PROTO_BASE_NETWORK_HDR, &expr->location, desc); break; case NFT_META_L4PROTO: |