tcp_xlate: Enclose LH flag values in parentheses

This fixes TCP flags matches:

| $ iptables-translate -A invalid -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
| nft add rule ip filter invalid tcp flags & fin|syn == fin|syn counter drop

Although the generated rule is syntactically correct and accepted by
nft, it will be interpreted in a different way than expected since
binary AND takes precedence over OR.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c
index 7f68b81288725365cc5e35309752ae9cb55801be..58f3c0a0c3c28c2022e6d7200a49ae34b02f6407 100644 (file)
--- a/extensions/libxt_tcp.c
+++ b/extensions/libxt_tcp.c
@@ -435,9 +435,9 @@ static int tcp_xlate(struct xt_xlate *xl,
                return 0;
 
        if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) {
-               xt_xlate_add(xl, "%stcp flags & ", space);
+               xt_xlate_add(xl, "%stcp flags & (", space);
                print_tcp_xlate(xl, tcpinfo->flg_mask);
-               xt_xlate_add(xl, " %s ",
+               xt_xlate_add(xl, ") %s ",
                           tcpinfo->invflags & XT_TCP_INV_FLAGS ? "!=": "==");
                print_tcp_xlate(xl, tcpinfo->flg_cmp);
        }