]> git.ipfire.org Git - thirdparty/iptables.git/commit
nft: Fix for broken recover_rule_compat()
authorPhil Sutter <phil@nwl.cc>
Tue, 27 Feb 2024 17:47:39 +0000 (18:47 +0100)
committerPhil Sutter <phil@nwl.cc>
Tue, 27 Feb 2024 18:41:02 +0000 (19:41 +0100)
commitbb1a7a5b297aa271f7f59abbcb891cd94d7fb305
tree57e06b2850481fd6466bfe357b7a4d4bfd1b6a9f
parentff57cd48d2b0c01c1519fd8893fc0432ad211702
nft: Fix for broken recover_rule_compat()

When IPv4 rule generator was changed to emit payload instead of
meta expressions for l4proto matches, the code reinserting
NFTNL_RULE_COMPAT_* attributes into rules being reused for counter
zeroing was broken by accident.

Make rule compat recovery aware of the alternative match, basically
reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules
with NFTA_RULE_COMPAT") but add a test case this time to make sure
things stay intact.

Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol")
Signed-off-by: Phil Sutter <phil@nwl.cc>
iptables/nft.c
iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 [new file with mode: 0755]