netlink_linearize: skip set element expression in flow table key

Anders reports that:

 # nft add rule ip6 filter postrouting \
	flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \}

while the opposite doesn't work:

 # nft add rule ip6 filter postrouting \
	flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \}

netlink_gen_flow_stmt() relies on the flow table key, that is expressed
as a set element. Use the set element key instead to skip the set
element wrap, otherwise get_register() abort execution:

 nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed.

Reported-by: Anders K. Pedersen <akp@cohaesio.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

0 files changed, 0 insertions, 0 deletions