summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2017-05-29 19:25:37 +0200
committerFlorian Westphal <fw@strlen.de>2017-06-06 20:53:13 +0200
commitae07c2361472b1852d886bf06ed9f2a1fd8aca38 (patch)
tree53fed20aaf8de499a875f04213348b4ee5ef6b84 /src
parent8786dc5f30db5a686c25de7cc80da1fd21082683 (diff)
meta: permit meta nfproto ip in ip family
works: add rule ip filter input ct original saddr 1.2.3.4 (family ctx init initialises network base to proto_ip). fails to parse 1.2.3.4 address: add rule ip filter input meta nfproto ipv4 ct original saddr 1.2.3.4 ... because meta_expr_pctx_update() won't find a dependency from "ip" to "ip" and then overwrites the correct base with proto_unknown. "meta nfproto ip" is useless in the ip family, as it will always match, i.e. a better (but more compliated) fix would be to remove the statement during evaluation. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
-rw-r--r--src/meta.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/src/meta.c b/src/meta.c
index cb7c1368..dd09d495 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -497,6 +497,7 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx,
const struct hook_proto_desc *h = &hook_proto_desc[ctx->family];
const struct expr *left = expr->left, *right = expr->right;
const struct proto_desc *desc;
+ uint8_t protonum;
assert(expr->op == OP_EQ);
@@ -514,10 +515,16 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx,
proto_ctx_update(ctx, PROTO_BASE_LL_HDR, &expr->location, desc);
break;
case NFT_META_NFPROTO:
- desc = proto_find_upper(h->desc, mpz_get_uint8(right->value));
- if (desc == NULL)
+ protonum = mpz_get_uint8(right->value);
+ desc = proto_find_upper(h->desc, protonum);
+ if (desc == NULL) {
desc = &proto_unknown;
+ if (protonum == ctx->family &&
+ h->base == PROTO_BASE_NETWORK_HDR)
+ desc = h->desc;
+ }
+
proto_ctx_update(ctx, PROTO_BASE_NETWORK_HDR, &expr->location, desc);
break;
case NFT_META_L4PROTO: