]> git.ipfire.org Git - thirdparty/nftables.git/commit
evaluate: reject: Have a generic fix for missing network context
authorPhil Sutter <phil@nwl.cc>
Tue, 30 Aug 2016 17:39:51 +0000 (19:39 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 5 Sep 2016 17:08:56 +0000 (19:08 +0200)
commit7241af302bbe56908fa87b17799048bfe884e35f
tree2d1c291116b85c6a31643702fcdfa6e39582b5ec
parent7a5b4c505e4d460239ac8a36b4fbccf222cd6134
evaluate: reject: Have a generic fix for missing network context

Commit 17b495957b29e ("evaluate: reject: fix crash if we have transport
protocol conflict from inet") took care of a crash when using inet or
bridge families, but since then netdev family has been added which also
does not implicitly define the network context. Therefore the crash can
be reproduced again using the following example:

nft add rule netdev filter e1000-ingress \
meta l4proto udp reject with tcp reset

In order to fix this in a more generic way, have stmt_evaluate_reset()
fall back to the generic proto_inet_service irrespective of the actual
proto context.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src/evaluate.c