Skip to contentSkip to conversation

src: netlink_linearize: Fix bug for redirect target

PATCH In review Shivani Bhardwaj 2 participants 2 messages Jan 28, 2016 – Feb 1, 2016 netfilter

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 src: netlink_linearize: Fix bug for redirect target

Before this patch,

$ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200
ip nat post
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ immediate reg 1 0x00006400 ]
  [ immediate reg 2 0x0000c800 ]
  [ redir proto_min reg 1 proto_max reg 5 ]

<cmdline>:1:1-56: Error: Could not process rule: Invalid argument add rule ip nat post ip protocol tcp redirect to 100-200 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

After this patch,

$ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200
ip nat post
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ immediate reg 1 0x00006400 ]
  [ immediate reg 2 0x0000c800 ]
  [ redir proto_min reg 1 proto_max reg 2 ]
---
 src/netlink_linearize.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)
src/netlink_linearize.c +9 -9
index 7c6ef16..dfe8dca 100644
@@ -861,17 +861,17 @@ static void netlink_gen_redir_stmt(struct netlink_linearize_ctx *ctx,
 					 pmin_reg);
 			netlink_gen_expr(ctx, stmt->redir.proto->right,
 					 pmax_reg);
-			nftnl_expr_set_u32(nle,
-					      NFTNL_EXPR_REDIR_REG_PROTO_MIN,
-					      pmin_reg);
-			nftnl_expr_set_u32(nle,
-					      NFTNL_EXPR_REDIR_REG_PROTO_MAX,
-					      pmax_reg);
+			netlink_put_register(nle,
+					     NFTNL_EXPR_REDIR_REG_PROTO_MIN,
+					     pmin_reg);
+			netlink_put_register(nle,
+					     NFTNL_EXPR_REDIR_REG_PROTO_MAX,
+					     pmax_reg);
 		} else {
 			netlink_gen_expr(ctx, stmt->redir.proto, pmin_reg);
-			nftnl_expr_set_u32(nle,
-					      NFTNL_EXPR_REDIR_REG_PROTO_MIN,
-					      pmin_reg);
+			netlink_put_register(nle,
+					     NFTNL_EXPR_REDIR_REG_PROTO_MIN,
+					     pmin_reg);
 		}
 	}
 
Signature · 1 line
1.9.1
#1 lore raw
Quoted 13 lines · Shivani Bhardwaj

Before this patch,

$ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200
ip nat post
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ immediate reg 1 0x00006400 ]
  [ immediate reg 2 0x0000c800 ]
  [ redir proto_min reg 1 proto_max reg 5 ]

<cmdline>:1:1-56: Error: Could not process rule: Invalid argument add rule ip nat post ip protocol tcp redirect to 100-200 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Quoted 8 lines

After this patch,

$ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200
ip nat post
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ immediate reg 1 0x00006400 ]
  [ immediate reg 2 0x0000c800 ]
  [ redir proto_min reg 1 proto_max reg 2 ]

Shivani, this is a very good catch. Applied, thanks!