* [PATCH] extensions: libxt_mark: fix a wrong translation to nft when mask is specified
@ 2016-06-01 12:07 Liping Zhang
2016-06-01 15:08 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Liping Zhang @ 2016-06-01 12:07 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, Liping Zhang, Shivani Bhardwaj
From: Liping Zhang <liping.zhang@spreadtrum.com>
The mask and mark's order is reversed, so when we specify the mask, we will
get the wrong translation result:
# iptables-translate -A INPUT -m mark --mark 0x1/0xff
nft add rule ip filter INPUT mark and 0x1 == 0xff counter
Apply this patch, translation will become:
# iptables-translate -A INPUT -m mark --mark 0x1/0xff
nft add rule ip filter INPUT mark and 0xff == 0x1 counter
Cc: Shivani Bhardwaj <shivanib134@gmail.com>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
extensions/libxt_mark.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c
index 939b4ac..6eccd5b 100644
--- a/extensions/libxt_mark.c
+++ b/extensions/libxt_mark.c
@@ -107,8 +107,8 @@ print_mark_xlate(struct xt_xlate *xl, unsigned int mark,
unsigned int mask, uint32_t op)
{
if (mask != 0xffffffffU)
- xt_xlate_add(xl, " and 0x%x %s 0x%x ", mark,
- op == XT_OP_EQ ? "==" : "!=", mask);
+ xt_xlate_add(xl, " and 0x%x %s 0x%x ", mask,
+ op == XT_OP_EQ ? "==" : "!=", mark);
else
xt_xlate_add(xl, " %s0x%x ",
op == XT_OP_EQ ? "" : "!= ", mark);
--
2.5.5
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] extensions: libxt_mark: fix a wrong translation to nft when mask is specified
2016-06-01 12:07 [PATCH] extensions: libxt_mark: fix a wrong translation to nft when mask is specified Liping Zhang
@ 2016-06-01 15:08 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2016-06-01 15:08 UTC (permalink / raw)
To: Liping Zhang; +Cc: netfilter-devel, Liping Zhang, Shivani Bhardwaj
On Wed, Jun 01, 2016 at 08:07:17PM +0800, Liping Zhang wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
>
> The mask and mark's order is reversed, so when we specify the mask, we will
> get the wrong translation result:
> # iptables-translate -A INPUT -m mark --mark 0x1/0xff
> nft add rule ip filter INPUT mark and 0x1 == 0xff counter
>
> Apply this patch, translation will become:
> # iptables-translate -A INPUT -m mark --mark 0x1/0xff
> nft add rule ip filter INPUT mark and 0xff == 0x1 counter
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-06-01 15:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-06-01 12:07 [PATCH] extensions: libxt_mark: fix a wrong translation to nft when mask is specified Liping Zhang
2016-06-01 15:08 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).