Liping Zhang <zlpnobody@xxxxxxx> wrote: > If we add a such nft rule: > nft add rule filter input ip protocol icmp tcp dport 0 > > we will always meet the assert condition: > nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed. > Aborted (core dumped) > --- > src/evaluate.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/src/evaluate.c b/src/evaluate.c > index 53f19b2..c317761 100644 > --- a/src/evaluate.c > +++ b/src/evaluate.c > @@ -533,7 +533,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx, > list_add_tail(&nstmt->list, &ctx->stmt->list); > } > > - assert(base < PROTO_BASE_MAX); > + assert(base <= PROTO_BASE_MAX); Right, BASE_MAX is in fact the transport header base. Applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
