The flags / mask syntax only allows for ==, != and the implicit
operation (which is == in this case).
# nft add rule x y tcp flags ! syn / syn,ack
Error: either == or != is allowed
add rule x y tcp flags ! syn / syn,ack
^^^^^^^^^^^^^^^^^^^^^^^^^
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
src/evaluate.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/evaluate.c b/src/evaluate.c
index 006b04affbd7..384e2fa786e0 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2139,6 +2139,10 @@ static int expr_evaluate_flagcmp(struct eval_ctx *ctx, struct expr **exprp)
{
struct expr *expr = *exprp, *binop, *rel;
+ if (expr->op != OP_EQ &&
+ expr->op != OP_NEQ)
+ return expr_error(ctx->msgs, expr, "either == or != is allowed");
+
binop = binop_expr_alloc(&expr->location, OP_AND,
expr_get(expr->flagcmp.expr),
expr_get(expr->flagcmp.mask));
--
2.20.1
