On 31 May 2016 at 09:22, Laura Garcia <nevola@xxxxxxxxx> wrote:
>> > +
>> > + for (i = 0; i < multiinfo->count; i++) {
>> > + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]);
>> > + if (i && multiinfo->invert)
>> > + return 0;
>>
>> This return here could mean that we build an incomplete nftables rule
>> (ie, missing '}')
>>
>
> Such condition cares that there is no translation in nftables for:
>
> tcp dport != { 80,88 }
>
> So the closed } doesn't even matter.
>
Then, at the start of the xlate function, I would suggest to do an
early return if we are about to translate an unsupported rule.
No need to keep checking if we are in the inversion case
>> > + if (multiinfo->count > 1 && !multiinfo->invert)
>> > + xt_xlate_add(xl, "}");
>> > +
like here
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
