diff options
| author | Florian Westphal <fw@strlen.de> | 2025-06-12 20:17:15 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2025-06-22 19:35:14 +0200 |
| commit | 44ea1936463728475768861073ca4ba34a5c2f75 (patch) | |
| tree | 693f05964e9935f5ae75926675d128ff07f68cd4 /src | |
| parent | 3cec07327ea2b91ac8395e0c0ee2a635a5e9fcd5 (diff) | |
src: BASECHAIN flag no longer implies presence of priority expression
The included bogon will crash nft because print side assumes that BASECHAIN
flag presence also means that priority expression is available.
Make the print side conditional.
Fixes: a66b5ad9540d ("src: allow for updating devices on existing netdev chain")
Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src')
| -rw-r--r-- | src/rule.c | 16 |
1 files changed, 10 insertions, 6 deletions
@@ -1047,8 +1047,10 @@ static void chain_print_declaration(const struct chain *chain, nft_print(octx, "\n\t\tcomment \"%s\"", chain->comment); nft_print(octx, "\n"); if (chain->flags & CHAIN_F_BASECHAIN) { - nft_print(octx, "\t\ttype %s hook %s", chain->type.str, - hooknum2str(chain->handle.family, chain->hook.num)); + if (chain->type.str) + nft_print(octx, "\t\ttype %s hook %s", chain->type.str, + hooknum2str(chain->handle.family, chain->hook.num)); + if (chain->dev_array_len == 1) { nft_print(octx, " device \"%s\"", chain->dev_array[0]); } else if (chain->dev_array_len > 1) { @@ -1060,10 +1062,12 @@ static void chain_print_declaration(const struct chain *chain, } nft_print(octx, " }"); } - nft_print(octx, " priority %s;", - prio2str(octx, priobuf, sizeof(priobuf), - chain->handle.family, chain->hook.num, - chain->priority.expr)); + + if (chain->priority.expr) + nft_print(octx, " priority %s;", + prio2str(octx, priobuf, sizeof(priobuf), + chain->handle.family, chain->hook.num, + chain->priority.expr)); if (chain->policy) { mpz_export_data(&policy, chain->policy->value, BYTEORDER_HOST_ENDIAN, sizeof(int)); |