@@ -308,29 +308,26 @@ impl FirewallRule for FilterRule<'_> {
308308 // 1 Protocol
309309 // > 0 Ports
310310 else if !self . dest_ports . is_empty ( ) {
311- if let Some ( protocol) = self . protocols . first ( ) {
312- if protocol. supports_ports ( ) {
313- let set = new_anon_set :: < InetService > (
314- chain. get_table ( ) ,
315- ProtoFamily :: Inet ,
316- true ,
317- ) ?;
318- batch. add ( & set, nftnl:: MsgType :: Add ) ;
319-
320- for port in self . dest_ports {
321- add_port_to_set ( set. as_ptr ( ) , port) ?;
322- }
323-
324- // <protocol> dport {x, x-x}
325- set. elems_iter ( ) . for_each ( |elem| {
326- batch. add ( & elem, nftnl:: MsgType :: Add ) ;
327- } ) ;
328-
329- rule. add_expr ( & nft_expr ! ( meta l4proto) ) ;
330- rule. add_expr ( & nft_expr ! ( cmp == * protocol as u8 ) ) ;
331- rule. add_expr ( protocol. as_port_payload_expr ( ) ?) ;
332- rule. add_expr ( & nft_expr ! ( lookup & set) ) ;
311+ if let Some ( protocol) = self . protocols . first ( )
312+ && protocol. supports_ports ( )
313+ {
314+ let set =
315+ new_anon_set :: < InetService > ( chain. get_table ( ) , ProtoFamily :: Inet , true ) ?;
316+ batch. add ( & set, nftnl:: MsgType :: Add ) ;
317+
318+ for port in self . dest_ports {
319+ add_port_to_set ( set. as_ptr ( ) , port) ?;
333320 }
321+
322+ // <protocol> dport {x, x-x}
323+ set. elems_iter ( ) . for_each ( |elem| {
324+ batch. add ( & elem, nftnl:: MsgType :: Add ) ;
325+ } ) ;
326+
327+ rule. add_expr ( & nft_expr ! ( meta l4proto) ) ;
328+ rule. add_expr ( & nft_expr ! ( cmp == * protocol as u8 ) ) ;
329+ rule. add_expr ( protocol. as_port_payload_expr ( ) ?) ;
330+ rule. add_expr ( & nft_expr ! ( lookup & set) ) ;
334331 }
335332
336333 debug ! (
0 commit comments