xtables: fix -p protocol
The protocol field in both IPv4 and IPv6 headers are 8 bits long,
so we have to compare 8 bits.
Reported-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index c368f40..c0ee4c8 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -91,6 +91,11 @@
nft_rule_add_expr(r, expr);
}
+void add_cmp_u8(struct nft_rule *r, uint8_t val, uint32_t op)
+{
+ add_cmp_ptr(r, op, &val, sizeof(val));
+}
+
void add_cmp_u16(struct nft_rule *r, uint16_t val, uint32_t op)
{
add_cmp_ptr(r, op, &val, sizeof(val));
@@ -159,7 +164,7 @@
}
void add_proto(struct nft_rule *r, int offset, size_t len,
- uint32_t proto, int invflags)
+ uint8_t proto, int invflags)
{
uint32_t op;
@@ -170,7 +175,7 @@
else
op = NFT_CMP_EQ;
- add_cmp_u32(r, proto, op);
+ add_cmp_u8(r, proto, op);
}
bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
index 59734d9..c59ab21 100644
--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
@@ -59,6 +59,7 @@
void add_payload(struct nft_rule *r, int offset, int len);
void add_bitwise_u16(struct nft_rule *r, int mask, int xor);
void add_cmp_ptr(struct nft_rule *r, uint32_t op, void *data, size_t len);
+void add_cmp_u8(struct nft_rule *r, uint8_t val, uint32_t op);
void add_cmp_u16(struct nft_rule *r, uint16_t val, uint32_t op);
void add_cmp_u32(struct nft_rule *r, uint32_t val, uint32_t op);
void add_iniface(struct nft_rule *r, char *iface, int invflags);
@@ -66,7 +67,7 @@
void add_addr(struct nft_rule *r, int offset,
void *data, size_t len, int invflags);
void add_proto(struct nft_rule *r, int offset, size_t len,
- uint32_t proto, int invflags);
+ uint8_t proto, int invflags);
void add_compat(struct nft_rule *r, uint32_t proto, bool inv);
bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
