Wrong arguments are passed to is_same_interfaces that causes sometimes to delete a wrong rule. See the example below: arptables-compat -A INPUT -i eth0 -j ACCEPT arptables-compat -A INPUT -i eth1 -j ACCEPT arptables-compat -A INPUT -i eth2 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth0 -j ACCEPT -i eth1 -j ACCEPT -i eth2 arptables-compat -D INPUT -i eth2 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth1 -j ACCEPT -i eth2 Signed-off-by: Giuseppe Longo <giuseppelng@xxxxxxxxx> --- iptables/nft-arp.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c index a494ee6..1af7202 100644 --- a/iptables/nft-arp.c +++ b/iptables/nft-arp.c @@ -631,14 +631,14 @@ static bool nft_arp_is_same(const void *data_a, return false; } - return is_same_interfaces(a->arp.src_devaddr.addr, - a->arp.tgt_devaddr.addr, - (unsigned char*)a->arp.src_devaddr.mask, - (unsigned char*)a->arp.tgt_devaddr.mask, - b->arp.src_devaddr.addr, - a->arp.tgt_devaddr.addr, - (unsigned char*)b->arp.src_devaddr.mask, - (unsigned char*)b->arp.tgt_devaddr.mask); + return is_same_interfaces(a->arp.iniface, + a->arp.outiface, + (unsigned char *)a->arp.iniface_mask, + (unsigned char *)a->arp.outiface_mask, + b->arp.iniface, + b->arp.outiface, + (unsigned char *)b->arp.iniface_mask, + (unsigned char *)b->arp.outiface_mask); } static bool nft_arp_rule_find(struct nft_family_ops *ops, struct nft_rule *r, -- 1.8.3.2 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
