From: Álvaro Neira Ayuso <alvaroneay@xxxxxxxxx> When we add this rule: sudo nft add rule ip test input ip protocol != icmp If we try to list the rules in the table test, nftables show this error: nft: src/payload.c:76: payload_expr_pctx_update: Assertion `expr->op == OP_EQ' failed. This patch moderates the checking by adding another clause like the expr operation can be non equal, not always equal. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@xxxxxxxxx> --- src/payload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/payload.c b/src/payload.c index a1785a5..b9ad6f7 100644 --- a/src/payload.c +++ b/src/payload.c @@ -73,7 +73,7 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx, if (!(left->flags & EXPR_F_PROTOCOL)) return; - assert(expr->op == OP_EQ); + assert(expr->op == OP_EQ || expr->op == OP_NEQ); base = ctx->protocol[left->payload.base].desc; desc = proto_find_upper(base, mpz_get_uint32(right->value)); -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
