Re: [iptables PATCH] nft: Reject tcp/udp extension without proper protocol match

[Phil Sutter <phil@xxxxxx>]

On Thu, Dec 22, 2022 at 04:03:10PM +0100, Phil Sutter wrote:
> Internally, 'th' expression is used, which works but matches both
> protocols. Since users won't expect '-m tcp --dport 1' to match UDP
> packets, catch missing/wrong '-p' argument.
> 
> Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match")
> Signed-off-by: Phil Sutter <phil@xxxxxx>

Patch applied.