Before this patch, comparison between rules with distinct number of expressions can returns that they are equals when they are not. Example: r1[e1, e2] == r2[e1, e2, e3] Reported-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Signed-off-by: Carlos Falgueras García <carlosfg@xxxxxxxxxx> --- src/rule.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/rule.c b/src/rule.c index ae7c478..9822d63 100644 --- a/src/rule.c +++ b/src/rule.c @@ -1102,6 +1102,7 @@ bool nftnl_rule_cmp(const struct nftnl_rule *r1, const struct nftnl_rule *r2) e1 = nftnl_expr_iter_next(&it1); e2 = nftnl_expr_iter_next(&it2); } + eq &= (e1 == NULL) && (e2 == NULL); /* Same number of expressions */ return eq; } -- 2.8.3 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
