From e7a1e66ec8e2a9a5b1d6a00aa6d2144ce29222e0 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 8 Jan 2016 01:44:39 +0100 Subject: netlink_linearize: use u64 conversion for 64bit quantities nft generated two 4-byte swaps for conntrack byte/packet counters, which are 64bit host-endian values: byteorder reg 1 = hton(reg 1, 4, 8) ] This makes the kernel perform two htonl() calls, but we need a cpu_to_be64 conversion instead (reg 1, 8, 8). Without this a rule like 'ct original packets > 10' matched when counter was between 1 and 10. Signed-off-by: Florian Westphal Acked-by: Pablo Neira Ayuso --- src/netlink_linearize.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'src/netlink_linearize.c') diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 48f5f027..c77c462b 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -592,6 +592,14 @@ static void netlink_gen_unary(struct netlink_linearize_ctx *ctx, enum nft_registers dreg) { struct nftnl_expr *nle; + int byte_size; + + if ((expr->arg->len % 64) == 0) + byte_size = 8; + else if ((expr->arg->len % 32) == 0) + byte_size = 4; + else + byte_size = 2; netlink_gen_expr(ctx, expr->arg, dreg); @@ -601,7 +609,7 @@ static void netlink_gen_unary(struct netlink_linearize_ctx *ctx, nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_LEN, expr->len / BITS_PER_BYTE); nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_SIZE, - expr->arg->len % 32 ? 2 : 4); + byte_size); nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_OP, netlink_gen_unary_op(expr->op)); nftnl_rule_add_expr(ctx->nlr, nle); -- cgit v1.2.3