| Message ID | 1463229815-39269-1-git-send-email-zlpnobody@163.com |
|---|---|
| State | Accepted |
| Commit | d4b86b6bfdf979a13c7cf4231bb4ec1d0c04d6a3 |
| Headers | show |
Liping Zhang <zlpnobody@163.com> wrote: > If we add a such nft rule: > nft add rule filter input ip protocol icmp tcp dport 0 > > we will always meet the assert condition: > nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed. > Aborted (core dumped) > --- > src/evaluate.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/src/evaluate.c b/src/evaluate.c > index 53f19b2..c317761 100644 > --- a/src/evaluate.c > +++ b/src/evaluate.c > @@ -533,7 +533,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx, > list_add_tail(&nstmt->list, &ctx->stmt->list); > } > > - assert(base < PROTO_BASE_MAX); > + assert(base <= PROTO_BASE_MAX); Right, BASE_MAX is in fact the transport header base. Applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/src/evaluate.c b/src/evaluate.c index 53f19b2..c317761 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -533,7 +533,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx, list_add_tail(&nstmt->list, &ctx->stmt->list); } - assert(base < PROTO_BASE_MAX); + assert(base <= PROTO_BASE_MAX); /* This payload and the existing context don't match, conflict. */ if (ctx->pctx.protocol[base + 1].desc != NULL) return 1;
From: Liping Zhang <liping.zhang@spreadtrum.com> If we add a such nft rule: nft add rule filter input ip protocol icmp tcp dport 0 we will always meet the assert condition: nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed. Aborted (core dumped) --- src/evaluate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)