diff options
| author | Florian Westphal <fw@strlen.de> | 2016-01-08 01:44:39 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2016-01-08 01:44:39 +0100 |
| commit | e7a1e66ec8e2a9a5b1d6a00aa6d2144ce29222e0 (patch) | |
| tree | 9194bdd38e85ecc475c9de2570fdc0e787da8e88 /src | |
| parent | 0bfbe6146418d93b2523ea56b43213cac5d6620c (diff) | |
netlink_linearize: use u64 conversion for 64bit quantities
nft generated two 4-byte swaps for conntrack byte/packet counters,
which are 64bit host-endian values:
byteorder reg 1 = hton(reg 1, 4, 8) ]
This makes the kernel perform two htonl() calls, but we need
a cpu_to_be64 conversion instead (reg 1, 8, 8).
Without this a rule like 'ct original packets > 10'
matched when counter was between 1 and 10.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/netlink_linearize.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 48f5f027..c77c462b 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -592,6 +592,14 @@ static void netlink_gen_unary(struct netlink_linearize_ctx *ctx, enum nft_registers dreg) { struct nftnl_expr *nle; + int byte_size; + + if ((expr->arg->len % 64) == 0) + byte_size = 8; + else if ((expr->arg->len % 32) == 0) + byte_size = 4; + else + byte_size = 2; netlink_gen_expr(ctx, expr->arg, dreg); @@ -601,7 +609,7 @@ static void netlink_gen_unary(struct netlink_linearize_ctx *ctx, nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_LEN, expr->len / BITS_PER_BYTE); nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_SIZE, - expr->arg->len % 32 ? 2 : 4); + byte_size); nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_OP, netlink_gen_unary_op(expr->op)); nftnl_rule_add_expr(ctx->nlr, nle); |