From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Patrick McHardy <kaber@trash.net>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nft] netlink_linearize: fix wrong comparison in netlink_gen_flagcmp()
Date: Mon, 17 Feb 2014 11:16:44 +0100 [thread overview]
Message-ID: <20140217101644.GA3971@localhost> (raw)
In-Reply-To: <20140216224331.GA23262@macbook.localnet>
On Sun, Feb 16, 2014 at 10:43:32PM +0000, Patrick McHardy wrote:
> On Sun, Feb 16, 2014 at 11:42:02PM +0100, Pablo Neira Ayuso wrote:
> > nft add rule filter input ct state established,related counter drop
> >
> > is not matching here due to a wrong comparison in the rule:
> >
> > ip filter input 20 19
> > [ ct load state => reg 1 ]
> > [ bitwise reg 1 = (reg=1 & 0x00000006 ) ^ 0x00000000 ]
> > [ cmp neq reg 1 0x00000006 ] <----- this has to be zero
> > [ counter pkts 0 bytes 0 ]
> > [ immediate reg 0 drop ]
> >
> > There's a line that generates the value from the right-hand
> > expression which was not in the original code. This bug was
> > introduced in aae836a ("src: use libnftables").
>
> I already pushed that patch two or three hours ago.
Thanks Patrick. I noticed this when testing state established,related.
Please, send your patches to nf-devel next time, I would have noticed
and saved that time.
next prev parent reply other threads:[~2014-02-17 10:16 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-16 22:42 [PATCH nft] netlink_linearize: fix wrong comparison in netlink_gen_flagcmp() Pablo Neira Ayuso
2014-02-16 22:43 ` Patrick McHardy
2014-02-17 10:16 ` Pablo Neira Ayuso [this message]
2014-02-17 10:25 ` Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140217101644.GA3971@localhost \
--to=pablo@netfilter.org \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.