nftables: do mot merge payloads on negation

commit f35a0d78fe870737fa39d859bd2e3ac25bf1b12e upstream.

else, a rule like
  tcp sport != 22 tcp dport != 23

will match even if the destination is 23 as long as sport is != 22.
(or vice versa).

Signed-off-by: Sriram Rajagopalan <sriramr@arista.com>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/rule.c b/src/rule.c
index dfc52825e5a22b96ac57d5b21651f8700469e14f..a0704d0385052a4c363f4f69f17a5154a3327b3c 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -2915,7 +2915,6 @@ static void stmt_reduce(const struct rule *rule)
                        switch (stmt->expr->op) {
                        case OP_EQ:
                        case OP_IMPLICIT:
-                       case OP_NEQ:
                                break;
                        default:
                                continue;