From: Liping Zhang <liping.zhang@xxxxxxxxxxxxxx>
The mask and mark's order is reversed, so when we specify the mask, we will
get the wrong translation result:
# iptables-translate -A INPUT -m mark --mark 0x1/0xff
nft add rule ip filter INPUT mark and 0x1 == 0xff counter
Apply this patch, translation will become:
# iptables-translate -A INPUT -m mark --mark 0x1/0xff
nft add rule ip filter INPUT mark and 0xff == 0x1 counter
Cc: Shivani Bhardwaj <shivanib134@xxxxxxxxx>
Signed-off-by: Liping Zhang <liping.zhang@xxxxxxxxxxxxxx>
---
extensions/libxt_mark.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c
index 939b4ac..6eccd5b 100644
--- a/extensions/libxt_mark.c
+++ b/extensions/libxt_mark.c
@@ -107,8 +107,8 @@ print_mark_xlate(struct xt_xlate *xl, unsigned int mark,
unsigned int mask, uint32_t op)
{
if (mask != 0xffffffffU)
- xt_xlate_add(xl, " and 0x%x %s 0x%x ", mark,
- op == XT_OP_EQ ? "==" : "!=", mask);
+ xt_xlate_add(xl, " and 0x%x %s 0x%x ", mask,
+ op == XT_OP_EQ ? "==" : "!=", mark);
else
xt_xlate_add(xl, " %s0x%x ",
op == XT_OP_EQ ? "" : "!= ", mark);
--
2.5.5
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
