summaryrefslogtreecommitdiffstats
path: root/libxtables
Commit message (Collapse)AuthorAgeFilesLines
* libxtables: Attenuate effects of functions' internal static buffersPhil Sutter2024-04-101-11/+9
| | | | | | | | | | | | | | | | | | | | While functions returning pointers to internal static buffers have obvious limitations, users are likely unaware how they call each other internally and thus won't notice unsafe use. One such case is calling both xtables_ipaddr_to_numeric() and xtables_ipmask_to_numeric() as parameters for a single printf() call. Defuse this trap by avoiding the internal calls to xtables_ip{,6}addr_to_numeric() which is easily doable since callers keep their own static buffers already. While being at it, make use of inet_ntop() everywhere and also use INET_ADDRSTRLEN/INET6_ADDRSTRLEN defines for correct (and annotated) static buffer sizes. Reported-by: Vitaly Chikunov <vt@altlinux.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
* libxtables: Add dccp and ipcomp to xtables_chain_protosPhil Sutter2024-02-071-0/+2
| | | | | | | | | | | There are "protocol extensions" for both just like with TCP or UDP. Caching their values allows for implicit extension lookup after '-p' flag, for instance: | iptables -A FORWARD -p dccp --dport 1 | iptables -A FORWARD -p ipcomp --ipcompspi 18 Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Respect min/max values when completing rangesPhil Sutter2024-02-021-3/+6
| | | | | | | | If an extension defines a minimum/maximum valid value for an option's range argument, treat this as the lower/upper boundary to use when completing (half) open ranges. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Reject negative port rangesPhil Sutter2024-02-021-1/+6
| | | | | | | Analogous to XTTYPE_UINT*RC value parsing, assert consecutive port values are not lower than previous ones. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Assert ranges are monotonic increasingPhil Sutter2024-02-021-4/+5
| | | | | | | | | | | Extensions commonly require the upper range value to be larger or equal to the lower one. Performing this check in the parser is easier and covers all extensions at once. One notable exception is NFQUEUE which requires strict monotonicity. Hence leave its checks in place. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix for memleak in option merging with ebtablesPhil Sutter2024-02-011-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The crucial difference in ebtables is that all extensions are loaded up front instead of while parsing -m/-j flags. Since this loading of all extensions before every call to do_parse() is pointless overhead (cf. ebtables-restore), other tools' mechanism of freeing all merged options in xtables_free_opts() after handling each command and resetting xt_params->opts at the start of the parser loop is problematic. Fixed commit entailed a hack to defeat the xt_params->opts happening at start of do_parse() by assigning to xt_params->orig_opts after loading all extensions. This approach caused a memleak though since xtables_free_opts() called from xtables_merge_options() will free the opts pointer only if it differs from orig_opts. Resolve this via a different approach which eliminates the xt_params->opts reset at the start of do_parse(): Make xt_params->opts be NULL until the first extension is loaded. Option merging in command_match() and command_jump() tolerates a NULL pointer there after minimal adjustment. Deinit in xtables_free_opts() is already fine as it (re)turns xt_params->opts to a NULL pointer. With do_parse() expecting that and falling back to xt_params->orig_opts, no explicit initialization is required anymore and thus ebtables' init is not mangled by accident. A critical part is that do_parse() checks xt_params->opts pointer upon each call to getopt_long() as it may get assigned while parsing. Fixes: 58d364c7120b5 ("ebtables: Use do_parse() from xshared") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix memleak of matches' udataPhil Sutter2024-02-011-0/+4
| | | | | | | | | | If the extension specifies a non-zero udata_size, field 'udata' points to an allocated buffer which needs to be freed upon extension deinit. Interestingly, this bug was identified by ASAN and missed by valgrind. Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Treat NFPROTO_BRIDGE as IPv4Phil Sutter2024-01-101-0/+1
| | | | | | | | | When parsing for XTTYPE_HOST(MASK), the return value of afinfo_family() is used to indicate the expected address family. Make guided option parser expect IPv4 by default for ebtables as this is the more common case. The exception is libebt_ip6, which will temporarily adjust afinfo->family while parsing.
* libxtables: xtoptions: Implement XTTYPE_ETHERMACMASKPhil Sutter2024-01-101-0/+10
| | | | | | Accept an Ethernet MAC address with optional mask in the format xtables_parse_mac_and_mask() expects it. Does not support XTOPT_PUT (for now) due to the lack of defined data structure.
* libxtables: xtoptions: Support XTOPT_NBO with XTTYPE_UINT*Phil Sutter2024-01-101-9/+31
| | | | | Value conversion into Big Endian byteorder is pretty straightforward, merely needed a small helper for uint64.
* libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASKPhil Sutter2024-01-101-1/+0
| | | | | | | | Do as the comment in xtopt_parse_hostmask() claims and omit XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() will catch the incompatibility. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
* libxtables: xtoptions: Fix for non-CIDR-compatible hostmasksPhil Sutter2023-11-291-0/+5
| | | | | | | | | | | | | | | | | | | In order to parse the mask, xtopt_parse_hostmask() calls xtopt_parse_plenmask() thereby limiting netmask support to prefix lengths (alternatively specified in IP address notation). In order to lift this impractical restriction, make xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may fall back to xtopt_parse_mask() which correctly initializes val.hmask itself and indicates non-CIDR-compatible masks by setting val.hlen to -1. So in order to support these odd masks, it is sufficient for xtopt_parse_plenmask() to skip its mask building from val.hlen value and take whatever val.hmask contains. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for garbage access in xtables_options_xfrm()Phil Sutter2023-11-291-1/+2
| | | | | | | | | | Allocation of the temporary array did not account for a terminating NULL entry, causing array boundary overstepping in the called xtables_merge_options(), causing spurious errors in extension parameter parsing. Fixes: ed8c3ea4015f0 ("libxtables: Combine the two extension option mergers") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce struct xt_option_entry::basePhil Sutter2023-11-231-1/+2
| | | | | | | Enable guided option parser users to parse integer values with a fixed base. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_strtoul_base()Phil Sutter2023-11-231-5/+11
| | | | | | | | Semantically identical to xtables_strtoul() but accepts the base as parameter so callers may force it irrespective of number prefix. The old xtables_strtoul() becomes a shallow wrapper. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix guided option parser for use with arptablesPhil Sutter2023-11-231-5/+18
| | | | | | | | With an unexpected value in afinfo->family, guided option parser was rather useless when called from arptables extensions. Introduce afinfo_family() wrapper to sanitize at least NFPROTO_ARP value. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Combine the two extension option mergersPhil Sutter2023-11-231-43/+8
| | | | | | | | | | For extending the command parser's struct option array, there is xtables_merge_options() and xtables_options_xfrm(). Since their bodies were almost identical, make the latter a wrapper of the former by transforming the passed struct xt_option_entry array into a temporary struct option one before handing over. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Use SOCK_CLOEXEC/O_CLOEXEC where availablePhil Sutter2023-08-101-13/+2
| | | | | | | | | | | | No need for the explicit fcntl() call, request the behaviour when opening the descriptor. One fcntl() call setting FD_CLOEXEC remains in extensions/libxt_bpf.c, the indirect syscall seems not to support passing the flag directly. Reported-by: Gaurav Gupta <g.gupta@samsung.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1104 Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xt_xlate_add() to take care of spacingPhil Sutter2022-11-291-6/+52
| | | | | | | | | | | | | | | | | | Try to eliminate most of the whitespace issues by separating strings from separate xt_xlate_add() calls by whitespace if needed. Cover the common case of consecutive range, list or MAC/IP address printing by inserting whitespace only if the string to be appended starts with an alphanumeric character or a brace. The latter helps to make spacing in anonymous sets consistent. Provide *_nospc() variants which disable the auto-spacing for the mandatory exception to the rule. Make things round by dropping any trailing whitespace before returning the buffer via xt_xlate_get(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* Drop extra newline from xtables_error() callsPhil Sutter2022-11-151-2/+2
| | | | | | | | | | Since basic_exit_err() appends a newline to the message itself, drop explicit ones. While being at it, fix indentation and join texts split over multiple lines. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix unsupported extension warning corner casePhil Sutter2022-07-021-0/+14
| | | | | | | | | | | | | | | | | | | | | Some extensions are not supported in revision 0 by user space anymore, for those the warning in xtables_compatible_revision() does not print as no revision 0 is tried. To fix this, one has to track if none of the user space supported revisions were accepted by the kernel. Therefore add respective logic to xtables_find_{target,match}(). Note that this does not lead to duplicated warnings for unsupported extensions that have a revision 0 because xtables_compatible_revision() returns true for them to allow for extension's help output. For the record, these ip6tables extensions are affected: set/SET, socket, tos/TOS, TPROXY and SNAT. In addition to that, TEE is affected for both families. Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.hPhil Sutter2022-06-232-2/+0
| | | | | | | | This is the last symbol in xshared.h used by libxtables, move it over. Again, treat this as "implementation detail" and hence put it behind XTABLES_INTERNAL-curtains. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Add --enable-profiling configure optionPhil Sutter2022-06-111-0/+1
| | | | | | A little convenience to prepare a build for analysis with gcov/gprof. Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: Fix error during out of tree buildBen Brown2022-05-251-1/+1
| | | | | | | | | | | Fixes the following error: ../../libxtables/xtables.c:52:10: fatal error: libiptc/linux_list.h: No such file or directory 52 | #include <libiptc/linux_list.h> Fixes: f58b0d7406451 ("libxtables: Implement notargets hash table") Signed-off-by: Ben Brown <ben@demerara.io> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "fix build for missing ETH_ALEN definition"Phil Sutter2022-05-251-3/+5
| | | | | | | | | | | | | This reverts commit c5d9a723b5159a28f547b577711787295a14fd84 as it broke compiling against musl libc. Might be a bug in the latter, but for the time being try to please both by avoiding the include and instead defining ETH_ALEN if unset. While being at it, move netinet/ether.h include up. Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Maciej Żenczykowski <maze@google.com>
* libxtables: Boost rule target checks by announcing chain namesPhil Sutter2022-03-171-0/+6
| | | | | | | | | | | | | | | | | When restoring a ruleset, feed libxtables with chain names from respective lines to avoid an extension search. While the user's intention is clear, this effectively disables the sanity check for clashes with target extensions. But: * The check yielded only a warning and the clashing chain was finally accepted. * Users crafting iptables dumps for feeding into iptables-restore likely know what they're doing. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* libxtables: Implement notargets hash tablePhil Sutter2022-03-171-0/+75
| | | | | | | | | Target lookup is relatively costly due to the filesystem access. Avoid this overhead in huge rulesets which contain many chain jumps by caching the failed lookups into a hashtable for later. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* libxtables: Fix for warning in xtables_ipmask_to_numericPhil Sutter2022-03-151-1/+1
| | | | | | | | | | | | | | | | | | Gcc complains: | xtables.c: In function 'xtables_ipmask_to_numeric': | xtables.c:1491:34: warning: '__builtin___sprintf_chk' may write a terminating nul past the end of the destination [-Wformat-overflow=] | 1491 | sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask)); | | ^ Indeed, xtables_ipaddr_to_numeric() returns a pointer to a 20 byte buffer and xtables_ipmask_to_numeric() writes its content into a buffer of same size at offset 1. Yet length of returned string is deterministic as it is an IPv4 address. So shrink it to the minimum of 16 bytes which eliminates the warning as well. Fixes: a96166c24eaac ("libxtables: add xtables_ip[6]mask_to_cidr") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Prefer xtables_chain_protos lookup over getprotoentPhil Sutter2022-03-101-13/+6
| | | | | | | | | | | | | | | | | | | | | | | When dumping a large ruleset, common protocol matches such as for TCP port number significantly slow down rule printing due to repeated calls for getprotobynumber(). The latter does not involve any caching, so /etc/protocols is consulted over and over again. As a simple countermeasure, make functions converting between proto number and name prefer the built-in list of "well-known" protocols. This is not a perfect solution, repeated rules for protocol names libxtables does not cache (e.g. igmp or dccp) will still be slow. Implementing getprotoent() result caching could solve this. As a side-effect, explicit check for pseudo-protocol "all" may be dropped as it is contained in the built-in list and therefore immutable. Also update xtables_chain_protos entries a bit to align with typical /etc/protocols contents. The testsuite assumes those names, so the preferred ones prior to this patch are indeed uncommon nowadays. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* Improve error messages for unsupported extensionsPhil Sutter2022-03-021-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a given extension was not supported by the kernel, iptables would print a rather confusing error message if extension parameters were given: | # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko | # iptables -A FORWARD -j LOG --log-prefix foo | iptables v1.8.7 (legacy): unknown option "--log-prefix" Avoid this by pretending extension revision 0 is always supported. It is the same hack as used to successfully print extension help texts as unprivileged user, extended to all error codes to serve privileged ones as well. In addition, print a warning if kernel rejected revision 0 and it's not a permissions problem. This helps users find out which extension in a rule the kernel didn't like. Finally, the above commands result in these messages: | Warning: Extension LOG revision 0 not supported, missing kernel module? | iptables: No chain/target/match by that name. Or, for iptables-nft: | Warning: Extension LOG revision 0 not supported, missing kernel module? | iptables v1.8.7 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain FORWARD Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Register only the highest revision extensionPhil Sutter2022-03-021-2/+8
| | | | | | | | | | | | When fully registering extensions, ignore all consecutive ones with same name and family value. Since commit b3ac87038f4e4 ("libxtables: Make sure extensions register in revision order"), one may safely assume the list of pending extensions has highest revision numbers first. Since iptables is only interested in the highest revision the kernel supports, registration and compatibility checks may be skipped once the first matching extension in pending list has validated. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Extend basic_exit_err()Phil Sutter2021-12-161-0/+12
| | | | | | | Basically merge the function with xtables_exit_error, printing a status-specific footer for parameter or version problems. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use xtables_{m,c}alloc() everywherePhil Sutter2021-08-311-9/+2
| | | | | | | | | | Make use of libxtables allocators where sensible to have implicit error checking. Leave library-internal calls in place to not create unexpected program exit points for users, apart from xt_xlate_alloc() as that function called xtables_error() in error case which exits by itself already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: exit if called by setuid executeableFlorian Westphal2021-08-041-0/+4
| | | | | | | | | iptables (legacy or nft, doesn't matter) cannot be safely used with setuid binaries. Add a safety check for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: extend xlate infrastructurePablo Neira Ayuso2021-06-071-18/+64
| | | | | | | | | | | | | | This infrastructure extends the existing xlate infrastructure: - Extensions can define set dependencies through .xlate. The resulting set definition can be obtained through xt_xlate_set_get(). - Add xl_xlate_set_family() and xl_xlate_get_family() to store/fetch the family. The first client of this new xlate API is the connlimit extension, which is added in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Introduce xtables_strdup() and use it everywherePhil Sutter2021-06-072-11/+15
| | | | | | This wraps strdup(), checking for errors. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix memleak in xtopt_parse_hostmask()Phil Sutter2021-06-071-0/+1
| | | | | | | The allocated hostmask duplicate needs to be freed again. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Drop leftover variable in xtables_numeric_to_ip6addr()Phil Sutter2021-06-071-2/+1
| | | | | | | Variable 'err' was only used in removed debug code, so drop it as well. Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code") Signed-off-by: Phil Sutter <phil@nwl.cc>
* fix build for missing ETH_ALEN definitionMaciej Żenczykowski2021-04-031-0/+1
| | | | | | | (this is needed at least with bionic) Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: Simplify xtables_ipmask_to_cidr() a bitPhil Sutter2021-03-091-10/+5
| | | | | | | Reduce the whole mask matching into a single for-loop. No need for a shortcut, /32 masks will match in the first iteration. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Extend MAC address printing/parsing supportPhil Sutter2020-12-031-0/+73
| | | | | | | | | | | | | | | Adding a parser which supports common names for special MAC/mask combinations and a print routine detecting those special addresses and printing the respective name allows to consolidate all the various duplicated implementations. The side-effects of this change are manageable: * arptables now accepts "BGA" as alias for the bridge group address * "mac" match now prints MAC addresses in lower-case which is consistent with the remaining code at least Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Register multiple extensions in ascending orderPhil Sutter2020-10-071-6/+8
| | | | | | | | | The newly introduced ordered insert algorithm in xtables_register_{match,target}() works best if extensions of same name are passed in ascending revisions. Since this is the case in about all extensions' arrays, iterate over them from beginning to end. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Simplify pending extension registrationPhil Sutter2020-10-071-95/+33
| | | | | | | | | | | | | | | | | | | | Assuming that pending extensions are sorted by first name and family, then descending revision, the decision where to insert a newly registered extension may be simplified by memorizing the previous registration (which obviously is of same name and family and higher revision). As a side-effect, fix for unsupported old extension revisions lingering in pending extension list forever and being retried with every use of the given extension. Any revision being rejected by the kernel may safely be dropped iff a previous (read: higher) revision was accepted already. Yet another side-effect of this change is the removal of an unwanted recursion by xtables_fully_register_pending_*() into itself via xtables_find_*(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Make sure extensions register in revision orderPhil Sutter2020-10-071-7/+64
| | | | | | | | | | | | Insert extensions into pending lists in ordered fashion: Group by extension name (and, for matches, family) and order groups by descending revision number. This allows to simplify the later full registration considerably. Since that involves kernel compatibility checks, the extra cycles here pay off eventually. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: compiler warning fixes for NO_SHARED_LIBSMaciej Żenczykowski2020-06-301-0/+4
| | | | | | | | | | | | Fixes two issues with NO_SHARED_LIBS: - #include <dlfcn.h> is ifdef'ed out and thus dlclose() triggers an undeclared function compiler warning - dlreg_add() is unused and thus triggers an unused function warning Test: builds without warnings Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Introduce xtables_fini()Phil Sutter2020-05-111-1/+43
| | | | | | | | | | | | Record handles of loaded shared objects in a linked list and dlclose() them from the newly introduced function. While functionally not necessary, this clears up valgrind's memcheck output when also displaying reachable memory. Since this is an extra function that doesn't change the existing API, increment both current and age. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Avoid buffer overrun in xtables_compatible_revision()Phil Sutter2019-12-061-1/+2
| | | | | The function is exported and accepts arbitrary strings as input. Calling strcpy() without length checks is not OK.
* xtables: Fix for false-positive rule matchingPhil Sutter2019-02-051-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | When comparing two rules with non-standard targets, differences in targets' payloads wasn't respected. The cause is a rather hideous one: Unlike xtables_find_match(), xtables_find_target() did not care whether the found target was already in use or not, so the same target instance was assigned to both rules and therefore payload comparison happened over the same memory location. With legacy iptables it is not possible to reuse a target: The only case where two rules (i.e., iptables_command_state instances) could exist at the same time is when comparing rules, but that's handled using libiptc. The above change clashes with ebtables-nft's reuse of target objects: While input parsing still just assigns the object from xtables_targets list, rule conversion from nftnl to iptables_command_state allocates new data. To fix this, make ebtables-nft input parsing use the common command_jump() routine instead of its own simplified copy. In turn, this also eliminates the ebtables-nft-specific variants of parse_target(), though with a slight change of behaviour: Names of user-defined chains are no longer allowed to contain up to 31 but merely 28 characters. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: xlate: init buffer to zeroFlorian Westphal2018-11-121-0/+1
| | | | | | | | | | | | | | Doesn't affect iptables-xlate, but nft (when built w. xtables support). Without this, nft can print random content if an extension doesn't add anything to the output xlate buffer, e.g. -p mh -m mh can cause nft to print random data after "meta l4proto mobility", as mh ->xlate doesn't do anything in this case. Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: add and use mac print helpersFlorian Westphal2018-11-071-0/+22
| | | | | | | | | | | | This changes ebtables-nft to consistently print mac address with two characters, i.e. 00:01:02:03:04:0a, not 0:1:2:3:4:a. Will require another bump of vcurrent/vage. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>