On Fri, Apr 04, 2014 at 11:44:33AM +0200, Pablo Neira Ayuso wrote: > On Fri, Apr 04, 2014 at 10:33:28AM +0200, Florian Westphal wrote: > > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > > On Mon, Mar 17, 2014 at 11:08:38PM +0100, Florian Westphal wrote: > > > > bitmask types default to flagcmp now, thus do not suppress OP_EQ. Else, > > > > > > > > rule filter output tcp flags syn > > > > rule filter output tcp flags == syn > > > > > > > > are both displayed as 'flags syn'. > > > > > > I believe that in other selectors: > > > > > > selector == value > > > selector value > > > > > > are equivalent. > > > > Yes, thats true. > > > > > I think it's not just that we have to fix the printing, but make it > > > consistent. > > > > Not sure, this was changed recently, see > > 6bad82aba5d304c7a2dd1b19fe57464dca327f4a > > (evaluate: use flagcmp for single RHS bitmask expression). > > That change is fine, I think we only have to fix tcp flags == syn to > make it equivalent to tcp flags syn. I don't find a good reason why > the should behave in a different way. Because the implicit op for bitmasks is to test for any of the given bits. tcp flags syn really should match on syn and syn/ack. If an equality relation is explicitly specified by the user, it also needs to be printed. Florian's change is all we need from what I can tell. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
