summaryrefslogtreecommitdiffstats
path: root/extensions/libxt_mark.c
diff options
context:
space:
mode:
authorLiping Zhang <liping.zhang@spreadtrum.com>2016-06-01 20:07:17 +0800
committerPablo Neira Ayuso <pablo@netfilter.org>2016-06-01 17:08:09 +0200
commit8548dd253833027c68ac6400c3118ef788fabe5d (patch)
tree94544de512f1390d4a3315230a8da9b3b9163e49 /extensions/libxt_mark.c
parent90becf12bd5823b6d59d32e99467f0d1e3a9ba17 (diff)
extensions: libxt_mark: fix a wrong translation to nft when mask is specified
The mask and mark's order is reversed, so when we specify the mask, we will get the wrong translation result: # iptables-translate -A INPUT -m mark --mark 0x1/0xff nft add rule ip filter INPUT mark and 0x1 == 0xff counter Apply this patch, translation will become: # iptables-translate -A INPUT -m mark --mark 0x1/0xff nft add rule ip filter INPUT mark and 0xff == 0x1 counter Cc: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_mark.c')
-rw-r--r--extensions/libxt_mark.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c
index 939b4acd..6eccd5b3 100644
--- a/extensions/libxt_mark.c
+++ b/extensions/libxt_mark.c
@@ -107,8 +107,8 @@ print_mark_xlate(struct xt_xlate *xl, unsigned int mark,
unsigned int mask, uint32_t op)
{
if (mask != 0xffffffffU)
- xt_xlate_add(xl, " and 0x%x %s 0x%x ", mark,
- op == XT_OP_EQ ? "==" : "!=", mask);
+ xt_xlate_add(xl, " and 0x%x %s 0x%x ", mask,
+ op == XT_OP_EQ ? "==" : "!=", mark);
else
xt_xlate_add(xl, " %s0x%x ",
op == XT_OP_EQ ? "" : "!= ", mark);