]> git.ipfire.org Git - thirdparty/nftables.git/commit
netlink_delinearize: only remove protocol if equal cmp is used
authorFlorian Westphal <fw@strlen.de>
Wed, 27 Jan 2016 01:53:51 +0000 (02:53 +0100)
committerFlorian Westphal <fw@strlen.de>
Wed, 27 Jan 2016 15:39:41 +0000 (16:39 +0100)
commitdcbfc8b14231f43695019ed456a355e37e4a8c84
treedcaf9de0245d79a077c82b7950f0e92ed36667da
parent7ecca3b785a67c5783ca61119d4490963837b0f0
netlink_delinearize: only remove protocol if equal cmp is used

Check for OP_EQ before removing a dependency, else we may zap wrong one,
changing the meaning of the rule.

Listing without patch:
ip protocol udp udp dport ssh
ip protocol udp udp dport ssh
counter packets 1 bytes 308 ip protocol udp udp dport ssh

With patch:
ip protocol != tcp udp dport ssh
ip protocol != udp udp dport ssh
ip protocol != tcp counter packets 1 bytes 308 udp dport ssh

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
src/netlink_delinearize.c
tests/py/ip/tcp.t [new file with mode: 0644]
tests/py/ip/tcp.t.payload [new file with mode: 0644]