netlink_delinearize: don't kill dependencies accross statements

nft currently translates
ip protocol tcp meta mark set 1 tcp dport 22
to
mark set 0x00000001 tcp dport 22

This is wrong, the latter form is same as

mark set 0x00000001 ip protocol tcp tcp dport 22

and thats not correct (original rule sets mark for tcp packets only).

We need to clear the dependency stack whenever we see a statement other
than stmt_expr, as these will have side effects (counter, payload
mangling, logging and the like).

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

0 files changed, 0 insertions, 0 deletions