]> git.ipfire.org Git - thirdparty/iptables.git/commit
projects / thirdparty / iptables.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ec86937) | patch
nft: Reject tcp/udp extension without proper protocol match
authorPhil Sutter <phil@nwl.cc>
Thu, 22 Dec 2022 14:58:27 +0000 (15:58 +0100)
committerPhil Sutter <phil@nwl.cc>
Thu, 22 Dec 2022 15:43:58 +0000 (16:43 +0100)
commit596f2e31ae7cee26e4f39f300cc69605f4ba512f
treebf6cd7dc6b5adaedfe2d32e50813f078e73f5658tree | snapshot
parentec86937089a95ac57f149b70cbf740d69b9bd775commit | diff
nft: Reject tcp/udp extension without proper protocol match

Internally, 'th' expression is used, which works but matches both
protocols. Since users won't expect '-m tcp --dport 1' to match UDP
packets, catch missing/wrong '-p' argument.

Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match")
Signed-off-by: Phil Sutter <phil@nwl.cc>
extensions/libxt_tcp.t diff | blob | blame | history
extensions/libxt_udp.t diff | blob | blame | history
iptables/nft.c diff | blob | blame | history
Mirror of git://git.netfilter.org/iptables