-- Thanks, Rick Hi, I found something strange in libnfnetlink.c, have a look at the following function: int nfnl_nfa_addattr_l(struct nfattr *nfa, int maxlen, int type, const void *data, int alen) { ...... if ((NFA_OK(nfa, nfa->nfa_len) + len) > maxlen) { errno = ENOSPC; return -1; } subnfa = (struct nfattr *)(((char *)nfa) + NFA_OK(nfa, nfa->nfa_len)); ..... } NFA_OK looks so weird here. I think it should be: int nfnl_nfa_addattr_l(struct nfattr *nfa, int maxlen, int type, const void *data, int alen) { ...... if ( NFA_ALIGN(nfa->nfa_len) + NFA_LENGTH(len) > maxlen) { errno = ENOSPC; return -1; } subnfa = (struct nfattr *)(((char *)nfa) + NFA_ALIGN( nfa->nfa_len)); ..... } Please kindly correct me if I made a mistake. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html