From: Anders K. Pedersen <akp@xxxxxxxxxxxx> I noticed that while # nft add rule ip6 filter postrouting \ flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \} works, the opposite order for the concatenated expressions fails: # nft add rule ip6 filter postrouting \ flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \} nft: netlink_linearize.c:634: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. I traced this down to get_register() and release_register(), where the EXPR_CONCAT handling isn't hit, when it's embedded in EXPR_SET_ELEM, and fixed it similarly to how EXPR_SET_ELEM is handled in netlink_gen_expr(). Signed-off-by: Anders K. Pedersen <akp@xxxxxxxxxxxx> --- src/netlink_linearize.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -73,6 +73,9 @@ static void __release_register(struct netlink_linearize_ctx *ctx, static enum nft_registers get_register(struct netlink_linearize_ctx *ctx, const struct expr *expr) { + if (expr && expr->ops->type == EXPR_SET_ELEM) + return get_register(ctx, expr->key); + if (expr && expr->ops->type == EXPR_CONCAT) return __get_register(ctx, expr->len); else @@ -82,6 +85,9 @@ static enum nft_registers get_register(struct netlink_linearize_ctx *ctx, static void release_register(struct netlink_linearize_ctx *ctx, const struct expr *expr) { + if (expr && expr->ops->type == EXPR_SET_ELEM) + return release_register(ctx, expr->key); + if (expr && expr->ops->type == EXPR_CONCAT) __release_register(ctx, expr->len); else ��.n��������+%������w��{.n����z�����n�r������&��z�ޗ�zf���h���~����������_��+v���)ߣ�