@@ -627,6 +627,17 @@ static void payload_dependency_store(struct rule_pp_ctx *ctx,
ctx->pdep = stmt;
}
+static void payload_elem_postprocess(struct expr *expr)
+{
+ switch (expr->ops->type) {
+ case EXPR_VALUE:
+ expr_switch_byteorder(expr);
+ break;
+ default:
+ break;
+ }
+}
+
static void payload_match_postprocess(struct rule_pp_ctx *ctx,
struct stmt *stmt, struct expr *expr)
{
@@ -677,6 +688,14 @@ static void payload_match_postprocess(struct rule_pp_ctx *ctx,
payload_expr_complete(left, &ctx->pctx);
expr_set_type(expr->right, expr->left->dtype,
expr->left->byteorder);
+
+ /* If we have rules that we have used payload with ranges or set
+ * we must to convert it to host endian for representing it
+ * correctly
+ */
+ if (left->dtype->byteorder == BYTEORDER_BIG_ENDIAN)
+ payload_elem_postprocess(expr->right);
+
payload_dependency_kill(ctx, expr->left);
break;
}
Currently when we try to use range values in nft rules doesn't work correctly. Usually this problem is related to incorrect byteorder conversion. I make the following solution for showing the range in the correct byteorder. Example: * nft add rule filter input tcp checksum 22-55 * nft list table filter tcp checksum >= 5632 tcp checksum <= 14080 And now, if we show it: * nft add rule filter input tcp checksum 22-55 * nft list table filter tcp checksum >= 22 tcp checksum <= 55 Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> --- [changes in v2] * Changed the solution for big endian and host endian cases. src/netlink_delinearize.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)