Before this patch, comparison between rules with distinct number of
expressions can returns that they are equals when they are not. Example:
r1[e1, e2] == r2[e1, e2, e3]
Reported-by: Pablo Neira Ayuso <[email protected]>
Signed-off-by: Carlos Falgueras García <[email protected]>
---
src/rule.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/rule.c b/src/rule.c
index ae7c478..9822d63 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -1102,6 +1102,7 @@ bool nftnl_rule_cmp(const struct nftnl_rule *r1, const
struct nftnl_rule *r2)
e1 = nftnl_expr_iter_next(&it1);
e2 = nftnl_expr_iter_next(&it2);
}
+ eq &= (e1 == NULL) && (e2 == NULL); /* Same number of expressions */
return eq;
}
--
2.8.3
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
