From fbea4a6f444988124235ca5b035b2e8eb427da4d Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 31 Oct 2016 14:29:58 +0100 Subject: netlink_linearize: skip set element expression in flow table key Anders reports that: # nft add rule ip6 filter postrouting \ flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \} while the opposite doesn't work: # nft add rule ip6 filter postrouting \ flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \} netlink_gen_flow_stmt() relies on the flow table key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Reported-by: Anders K. Pedersen Signed-off-by: Pablo Neira Ayuso --- tests/py/ip6/flowtable.t | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 tests/py/ip6/flowtable.t (limited to 'tests/py/ip6/flowtable.t') diff --git a/tests/py/ip6/flowtable.t b/tests/py/ip6/flowtable.t new file mode 100644 index 00000000..ae408b78 --- /dev/null +++ b/tests/py/ip6/flowtable.t @@ -0,0 +1,6 @@ +:input;type filter hook input priority 0 + +*ip6;test-ip6;input + +flow table acct_out { meta iif . ip6 saddr timeout 600s counter };ok;flow table acct_out { iif . ip6 saddr timeout 10m counter packets 0 bytes 0} +flow table acct_out { ip6 saddr . meta iif timeout 600s counter };ok;flow table acct_out { ip6 saddr . iif timeout 10m counter packets 0 bytes 0} -- cgit v1.2.3