| Message ID | 20160128193537.GA23701@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Fri, Jan 29, 2016 at 01:05:37AM +0530, Shivani Bhardwaj wrote: > Before this patch, > $ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200 > ip nat post > [ payload load 1b @ network header + 9 => reg 1 ] > [ cmp eq reg 1 0x00000006 ] > [ immediate reg 1 0x00006400 ] > [ immediate reg 2 0x0000c800 ] > [ redir proto_min reg 1 proto_max reg 5 ] > > <cmdline>:1:1-56: Error: Could not process rule: Invalid argument > add rule ip nat post ip protocol tcp redirect to 100-200 > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > After this patch, > $ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200 > ip nat post > [ payload load 1b @ network header + 9 => reg 1 ] > [ cmp eq reg 1 0x00000006 ] > [ immediate reg 1 0x00006400 ] > [ immediate reg 2 0x0000c800 ] > [ redir proto_min reg 1 proto_max reg 2 ] Shivani, this is a very good catch. Applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 7c6ef16..dfe8dca 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -861,17 +861,17 @@ static void netlink_gen_redir_stmt(struct netlink_linearize_ctx *ctx, pmin_reg); netlink_gen_expr(ctx, stmt->redir.proto->right, pmax_reg); - nftnl_expr_set_u32(nle, - NFTNL_EXPR_REDIR_REG_PROTO_MIN, - pmin_reg); - nftnl_expr_set_u32(nle, - NFTNL_EXPR_REDIR_REG_PROTO_MAX, - pmax_reg); + netlink_put_register(nle, + NFTNL_EXPR_REDIR_REG_PROTO_MIN, + pmin_reg); + netlink_put_register(nle, + NFTNL_EXPR_REDIR_REG_PROTO_MAX, + pmax_reg); } else { netlink_gen_expr(ctx, stmt->redir.proto, pmin_reg); - nftnl_expr_set_u32(nle, - NFTNL_EXPR_REDIR_REG_PROTO_MIN, - pmin_reg); + netlink_put_register(nle, + NFTNL_EXPR_REDIR_REG_PROTO_MIN, + pmin_reg); } }
Before this patch, $ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200 ip nat post [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ immediate reg 1 0x00006400 ] [ immediate reg 2 0x0000c800 ] [ redir proto_min reg 1 proto_max reg 5 ] <cmdline>:1:1-56: Error: Could not process rule: Invalid argument add rule ip nat post ip protocol tcp redirect to 100-200 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ After this patch, $ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200 ip nat post [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ immediate reg 1 0x00006400 ] [ immediate reg 2 0x0000c800 ] [ redir proto_min reg 1 proto_max reg 2 ] Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> --- src/netlink_linearize.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)