xtables-compat: ignore '+' interface name

its same as omitting it, so instead of generating
invalid compare-with-0-sized-register, just ignore it.

Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 1d9554d36eeb1a0d1fe5c997df6709622a3e4a5e..b89a3e7b9d31b2b744387c1d0d4d9807c623bf63 100644 (file)
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -139,9 +139,10 @@ void add_iniface(struct nftnl_rule *r, char *iface, uint32_t op)
        iface_len = strlen(iface);
 
        add_meta(r, NFT_META_IIFNAME);
-       if (iface[iface_len - 1] == '+')
-               add_cmp_ptr(r, op, iface, iface_len - 1);
-       else
+       if (iface[iface_len - 1] == '+') {
+               if (iface_len > 1)
+                       add_cmp_ptr(r, op, iface, iface_len - 1);
+       } else
                add_cmp_ptr(r, op, iface, iface_len + 1);
 }
 
@@ -152,9 +153,10 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
        iface_len = strlen(iface);
 
        add_meta(r, NFT_META_OIFNAME);
-       if (iface[iface_len - 1] == '+')
-               add_cmp_ptr(r, op, iface, iface_len - 1);
-       else
+       if (iface[iface_len - 1] == '+') {
+               if (iface_len > 1)
+                       add_cmp_ptr(r, op, iface, iface_len - 1);
+       } else
                add_cmp_ptr(r, op, iface, iface_len + 1);
 }