Hi,
this patch fixes the check of the subsystem in bsf.c.
At the moment, NFCT_FILTER_ACCEPT is set, even if the comparison of the
subsystem and the expected subsystem returns false.
florian
Signed-off-by: Lehner Florian <nfct@xxxxxxxxxxx>
---
src/conntrack/bsf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/conntrack/bsf.c b/src/conntrack/bsf.c
index 1549815..1dc89ab 100644
--- a/src/conntrack/bsf.c
+++ b/src/conntrack/bsf.c
@@ -304,7 +304,7 @@ bsf_cmp_subsys(struct sock_filter *this, int pos,
uint8_t subsys)
.k = sizeof(uint8_t),
},
[2] = {
- /* A == subsys ? jump +1 : accept */
+ /* A == subsys ? jump +1 : reject */
.code = BPF_JMP|BPF_JEQ|BPF_K,
.k = subsys,
.jt = 1,
@@ -745,7 +745,7 @@ int __setup_netlink_socket_filter(int fd, struct
nfct_filter *f)
memset(bsf, 0, sizeof(bsf));
j += bsf_cmp_subsys(&bsf[j], j, NFNL_SUBSYS_CTNETLINK);
- j += nfct_bsf_ret_verdict(bsf, NFCT_FILTER_ACCEPT, j);
+ j += nfct_bsf_ret_verdict(bsf, NFCT_FILTER_REJECT, j);
show_filter(bsf, from, j, "--- check subsys ---");
from = j;
j += bsf_add_proto_filter(f, &bsf[j]);
--
2.17.1
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
