Hi, this patch fixes the check of the subsystem in bsf.c. At the moment, NFCT_FILTER_ACCEPT is set, even if the comparison of the subsystem and the expected subsystem returns false.
florian Signed-off-by: Lehner Florian <[email protected]> --- src/conntrack/bsf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/conntrack/bsf.c b/src/conntrack/bsf.c index 1549815..1dc89ab 100644 --- a/src/conntrack/bsf.c +++ b/src/conntrack/bsf.c @@ -304,7 +304,7 @@ bsf_cmp_subsys(struct sock_filter *this, int pos, uint8_t subsys) .k = sizeof(uint8_t), }, [2] = { - /* A == subsys ? jump +1 : accept */ + /* A == subsys ? jump +1 : reject */ .code = BPF_JMP|BPF_JEQ|BPF_K, .k = subsys, .jt = 1, @@ -745,7 +745,7 @@ int __setup_netlink_socket_filter(int fd, struct nfct_filter *f) memset(bsf, 0, sizeof(bsf)); j += bsf_cmp_subsys(&bsf[j], j, NFNL_SUBSYS_CTNETLINK); - j += nfct_bsf_ret_verdict(bsf, NFCT_FILTER_ACCEPT, j); + j += nfct_bsf_ret_verdict(bsf, NFCT_FILTER_REJECT, j); show_filter(bsf, from, j, "--- check subsys ---"); from = j; j += bsf_add_proto_filter(f, &bsf[j]); -- 2.17.1 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
