diff options
author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-06-01 20:07:17 +0800 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-06-01 17:08:09 +0200 |
commit | 8548dd253833027c68ac6400c3118ef788fabe5d (patch) | |
tree | 94544de512f1390d4a3315230a8da9b3b9163e49 /extensions/libxt_mark.c | |
parent | 90becf12bd5823b6d59d32e99467f0d1e3a9ba17 (diff) |
extensions: libxt_mark: fix a wrong translation to nft when mask is specified
The mask and mark's order is reversed, so when we specify the mask, we will
get the wrong translation result:
# iptables-translate -A INPUT -m mark --mark 0x1/0xff
nft add rule ip filter INPUT mark and 0x1 == 0xff counter
Apply this patch, translation will become:
# iptables-translate -A INPUT -m mark --mark 0x1/0xff
nft add rule ip filter INPUT mark and 0xff == 0x1 counter
Cc: Shivani Bhardwaj <shivanib134@gmail.com>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_mark.c')
-rw-r--r-- | extensions/libxt_mark.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c index 939b4acd..6eccd5b3 100644 --- a/extensions/libxt_mark.c +++ b/extensions/libxt_mark.c @@ -107,8 +107,8 @@ print_mark_xlate(struct xt_xlate *xl, unsigned int mark, unsigned int mask, uint32_t op) { if (mask != 0xffffffffU) - xt_xlate_add(xl, " and 0x%x %s 0x%x ", mark, - op == XT_OP_EQ ? "==" : "!=", mask); + xt_xlate_add(xl, " and 0x%x %s 0x%x ", mask, + op == XT_OP_EQ ? "==" : "!=", mark); else xt_xlate_add(xl, " %s0x%x ", op == XT_OP_EQ ? "" : "!= ", mark); |