diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-31 14:29:58 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-31 15:14:24 +0100 |
| commit | fbea4a6f444988124235ca5b035b2e8eb427da4d (patch) | |
| tree | d3f341d934094da6d240c1b722d06956f6fe27cf /src/netlink_linearize.c | |
| parent | eee1eeea57358db5b65a79b6b2585c1651f01008 (diff) | |
netlink_linearize: skip set element expression in flow table key
Anders reports that:
# nft add rule ip6 filter postrouting \
flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \}
while the opposite doesn't work:
# nft add rule ip6 filter postrouting \
flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \}
netlink_gen_flow_stmt() relies on the flow table key, that is expressed
as a set element. Use the set element key instead to skip the set
element wrap, otherwise get_register() abort execution:
nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed.
Reported-by: Anders K. Pedersen <akp@cohaesio.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink_linearize.c')
| -rw-r--r-- | src/netlink_linearize.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index b5967d49..0458af95 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -1124,9 +1124,9 @@ static void netlink_gen_flow_stmt(struct netlink_linearize_ctx *ctx, enum nft_dynset_ops op; struct set *set; - sreg_key = get_register(ctx, stmt->flow.key); - netlink_gen_expr(ctx, stmt->flow.key, sreg_key); - release_register(ctx, stmt->flow.key); + sreg_key = get_register(ctx, stmt->flow.key->key); + netlink_gen_expr(ctx, stmt->flow.key->key, sreg_key); + release_register(ctx, stmt->flow.key->key); set = stmt->flow.set->set; if (stmt->flow.key->timeout) |