path: root/src/netlink_linearize.c
diff options
authorPablo Neira Ayuso <>2016-10-31 14:29:58 +0100
committerPablo Neira Ayuso <>2016-10-31 15:14:24 +0100
commitfbea4a6f444988124235ca5b035b2e8eb427da4d (patch)
treed3f341d934094da6d240c1b722d06956f6fe27cf /src/netlink_linearize.c
parenteee1eeea57358db5b65a79b6b2585c1651f01008 (diff)
netlink_linearize: skip set element expression in flow table key
Anders reports that: # nft add rule ip6 filter postrouting \ flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \} while the opposite doesn't work: # nft add rule ip6 filter postrouting \ flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \} netlink_gen_flow_stmt() relies on the flow table key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Reported-by: Anders K. Pedersen <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'src/netlink_linearize.c')
1 files changed, 3 insertions, 3 deletions
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index b5967d49..0458af95 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -1124,9 +1124,9 @@ static void netlink_gen_flow_stmt(struct netlink_linearize_ctx *ctx,
enum nft_dynset_ops op;
struct set *set;
- sreg_key = get_register(ctx, stmt->flow.key);
- netlink_gen_expr(ctx, stmt->flow.key, sreg_key);
- release_register(ctx, stmt->flow.key);
+ sreg_key = get_register(ctx, stmt->flow.key->key);
+ netlink_gen_expr(ctx, stmt->flow.key->key, sreg_key);
+ release_register(ctx, stmt->flow.key->key);
set = stmt->flow.set->set;
if (stmt->flow.key->timeout)