From fbea4a6f444988124235ca5b035b2e8eb427da4d Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 31 Oct 2016 14:29:58 +0100 Subject: netlink_linearize: skip set element expression in flow table key Anders reports that: # nft add rule ip6 filter postrouting \ flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \} while the opposite doesn't work: # nft add rule ip6 filter postrouting \ flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \} netlink_gen_flow_stmt() relies on the flow table key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Reported-by: Anders K. Pedersen Signed-off-by: Pablo Neira Ayuso --- src/netlink_linearize.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src/netlink_linearize.c') diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index b5967d49..0458af95 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -1124,9 +1124,9 @@ static void netlink_gen_flow_stmt(struct netlink_linearize_ctx *ctx, enum nft_dynset_ops op; struct set *set; - sreg_key = get_register(ctx, stmt->flow.key); - netlink_gen_expr(ctx, stmt->flow.key, sreg_key); - release_register(ctx, stmt->flow.key); + sreg_key = get_register(ctx, stmt->flow.key->key); + netlink_gen_expr(ctx, stmt->flow.key->key, sreg_key); + release_register(ctx, stmt->flow.key->key); set = stmt->flow.set->set; if (stmt->flow.key->timeout) -- cgit v1.2.3