[PATCH] nft-arp: remove wrong conditions

[PATCH] nft-arp: remove wrong conditions

[Giuseppe Longo]

Removes wrong conditions in flags translating functions
that doesn't permit to delete rule with inverse flags set.

For instance, the following command doesn't remove the rule:
arptables-compat -D INPUT -i ! eth1 -j ACCEPT

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
 iptables/nft-arp.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index c1cbbc0..c3cfee9 100644
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -155,9 +155,6 @@ static uint8_t arpt_to_ipt_flags(uint16_t invflags)
 	if (invflags & ARPT_INV_ARPPRO)
 		result |= IPT_INV_PROTO;
 
-	if (invflags & ARPT_INV_MASK)
-		result |= IPT_INV_MASK;
-
 	return result;
 }
 
@@ -257,9 +254,6 @@ static uint16_t ipt_to_arpt_flags(uint8_t invflags)
 	if (invflags & IPT_INV_PROTO)
 		result |= ARPT_INV_ARPPRO;
 
-	if (invflags & IPT_INV_MASK)
-		result |= ARPT_INV_MASK;
-
 	return result;
 }
 
-- 
1.8.3.2

Re: [PATCH] nft-arp: remove wrong conditions

[Pablo Neira Ayuso]

On Sat, Aug 09, 2014 at 01:04:17AM +0200, Giuseppe Longo wrote:
> Removes wrong conditions in flags translating functions
> that doesn't permit to delete rule with inverse flags set.
> 
> For instance, the following command doesn't remove the rule:
> arptables-compat -D INPUT -i ! eth1 -j ACCEPT

Applied, thanks.

There's another bug in arptables-compat:

arptables: Bad rule (does a matching rule exist in that chain?)

It doesn't say that if you try to delete an unexistent rule.

Please, have a look at it and fix it, thanks.