From: Liping Zhang <liping.zhang@xxxxxxxxxxxxxx> If we add a such nft rule: nft add rule filter input ip protocol icmp tcp dport 0 we will always meet the assert condition: nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed. Aborted (core dumped) --- src/evaluate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evaluate.c b/src/evaluate.c index 53f19b2..c317761 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -533,7 +533,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx, list_add_tail(&nstmt->list, &ctx->stmt->list); } - assert(base < PROTO_BASE_MAX); + assert(base <= PROTO_BASE_MAX); /* This payload and the existing context don't match, conflict. */ if (ctx->pctx.protocol[base + 1].desc != NULL) return 1; -- 2.5.5 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
