| Message ID | 20161129114725.12735-1-phil@nwl.cc |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Tue, Nov 29, 2016 at 12:47:25PM +0100, Phil Sutter wrote: > This fixes TCP flags matches: > > | $ iptables-translate -A invalid -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP > | nft add rule ip filter invalid tcp flags & fin|syn == fin|syn counter drop > > Although the generated rule is syntactically correct and accepted by > nft, it will be interpreted in a different way than expected since > binary AND takes precedence over OR. And this one also applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c index 7f68b81288725..58f3c0a0c3c28 100644 --- a/extensions/libxt_tcp.c +++ b/extensions/libxt_tcp.c @@ -435,9 +435,9 @@ static int tcp_xlate(struct xt_xlate *xl, return 0; if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { - xt_xlate_add(xl, "%stcp flags & ", space); + xt_xlate_add(xl, "%stcp flags & (", space); print_tcp_xlate(xl, tcpinfo->flg_mask); - xt_xlate_add(xl, " %s ", + xt_xlate_add(xl, ") %s ", tcpinfo->invflags & XT_TCP_INV_FLAGS ? "!=": "=="); print_tcp_xlate(xl, tcpinfo->flg_cmp); }
This fixes TCP flags matches: | $ iptables-translate -A invalid -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP | nft add rule ip filter invalid tcp flags & fin|syn == fin|syn counter drop Although the generated rule is syntactically correct and accepted by nft, it will be interpreted in a different way than expected since binary AND takes precedence over OR. Signed-off-by: Phil Sutter <phil@nwl.cc> --- extensions/libxt_tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)