From 8548dd253833027c68ac6400c3118ef788fabe5d Mon Sep 17 00:00:00 2001 From: Liping Zhang Date: Wed, 1 Jun 2016 20:07:17 +0800 Subject: extensions: libxt_mark: fix a wrong translation to nft when mask is specified The mask and mark's order is reversed, so when we specify the mask, we will get the wrong translation result: # iptables-translate -A INPUT -m mark --mark 0x1/0xff nft add rule ip filter INPUT mark and 0x1 == 0xff counter Apply this patch, translation will become: # iptables-translate -A INPUT -m mark --mark 0x1/0xff nft add rule ip filter INPUT mark and 0xff == 0x1 counter Cc: Shivani Bhardwaj Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_mark.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'extensions/libxt_mark.c') diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c index 939b4acd..6eccd5b3 100644 --- a/extensions/libxt_mark.c +++ b/extensions/libxt_mark.c @@ -107,8 +107,8 @@ print_mark_xlate(struct xt_xlate *xl, unsigned int mark, unsigned int mask, uint32_t op) { if (mask != 0xffffffffU) - xt_xlate_add(xl, " and 0x%x %s 0x%x ", mark, - op == XT_OP_EQ ? "==" : "!=", mask); + xt_xlate_add(xl, " and 0x%x %s 0x%x ", mask, + op == XT_OP_EQ ? "==" : "!=", mark); else xt_xlate_add(xl, " %s0x%x ", op == XT_OP_EQ ? "" : "!= ", mark); -- cgit v1.2.3