On Tue, Sep 16, 2014 at 02:21:19PM +0200, Alvaro Neira Ayuso wrote:
> If we try to add a rule like:
>
> nft add rule filter input udp length {55-9999}
>
> nftable shows:
>
> BUG: invalid byte order conversion 0 => 2
> nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed.
>
> Some of the existing payload fields rely on BYTEORDER_INVALID. Therefore, if we
> try to convert it in evaluation step, we hit this bug.
>
> This patch allows to add a specific byteorder to the struct proto_hdr_template. If
> we create a expression with a invalid byteorder, we will use the byteorder
> added to the proto_hdr_template structure.
>
> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@xxxxxxxxx>
> ---
> [Changes in v2]
> * Use host endian byteorder in the ether saddr/daddr rules.
>
> [Tested with the rules]
> nft add rule ip filter input ip length 10-55 counter
> nft add rule ip filter input ip length 55-1000 counter
> nft add rule ip filter input udp length {0-100} udp dport 9999 counter
> nft add rule ip filter input udp length {100-9999} udp dport 9999 counter
> nft add rule bridge filter input ether type 0x0800 counter
> nft add rule bridge filter input ether saddr 12:34:56:78.9a:bc counter
> nft add rule bridge filter input ether daddr 12:34:56:78:9a:bc counter
> Tested with the Ana Rey's tests
Applied, thanks Alvaro.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
