From 3b4f35eee51884f581223188a71f84ef782eb726 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 24 May 2021 21:54:36 +0200 Subject: evaluate: allow == and != in the new shortcut syntax to match for flags The flags / mask syntax only allows for ==, != and the implicit operation (which is == in this case). # nft add rule x y tcp flags ! syn / syn,ack Error: either == or != is allowed add rule x y tcp flags ! syn / syn,ack ^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/evaluate.c b/src/evaluate.c index 006b04af..384e2fa7 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2139,6 +2139,10 @@ static int expr_evaluate_flagcmp(struct eval_ctx *ctx, struct expr **exprp) { struct expr *expr = *exprp, *binop, *rel; + if (expr->op != OP_EQ && + expr->op != OP_NEQ) + return expr_error(ctx->msgs, expr, "either == or != is allowed"); + binop = binop_expr_alloc(&expr->location, OP_AND, expr_get(expr->flagcmp.expr), expr_get(expr->flagcmp.mask)); -- cgit v1.2.3