Reversed byte order issue with nft ?

Reversed byte order issue with nft ?

[leroy christophe]

Hi,

When doing 'nft list ruleset', I get a bad result (see below), fields 
appear as "unknown" and/or as numeric values.

Running 'nft' with gdb, it looks like something is wrong with byte ordering:

In function symbolic_constant_print(), mpz_export_data() return a 
strange val.
First time we go there, we get 0x800000000
Next time, we get 0x400000000
Last time, we get 0x200000000
While we expect 8(new), 4(related), 2(established)

Any idea on what to do ?

Target is a powerpc (big endian), everything is cross-compiled using GNU 
tools on x86 (little endian)

kernel 3.18-rc7
nftables-20141121
libnftnl-20141121
gmp-4.3.2
libmnl-1.0.3
libnfnetlink-1.0.1
libnetfilter_conntrack-1.0.4

Thanks
Christophe

# uname -a
Linux vgoip 3.18.0-rc7-local-dirty #94 PREEMPT Wed Dec 3 17:25:41 CET 
2014 ppc GNU/Linux
# nft -f /etc/nftables.conf
# nft list ruleset
table ip filter {
         chain input {
                  type filter hook input priority 0;
                  oifname "lo" accept
                  ct state { 4, 2} accept
                  ct state 8 unknown unknown 0x16 [invalid type] accept
                  ip protocol icmp accept
         }

         chain forward {
                  type filter hook forward priority 0;
                  drop
         }
}

# cat /etc/nftables.conf
flush ruleset
table ip filter {
         chain input {
                  type filter hook input priority 0;
                  oifname "lo" accept
                  ct state { established, related} accept
                  ct state new tcp dport 22 accept
                  ip protocol icmp accept
         }

         chain forward {
                  type filter hook forward priority 0;
                  drop
         }
}

Re: Reversed byte order issue with nft ?

[Pablo Neira Ayuso]

On Wed, Dec 03, 2014 at 06:20:59PM +0100, leroy christophe wrote:
> Hi,
> 
> When doing 'nft list ruleset', I get a bad result (see below),
> fields appear as "unknown" and/or as numeric values.

Please, test this:

http://patchwork.ozlabs.org/patch/417775/

and confirm that this resolves your problem. Thank you.

Re: Reversed byte order issue with nft ?

[leroy christophe]

v2 tested, it works.

Thanks a lot.
Christophe

Le 04/12/2014 14:27, Pablo Neira Ayuso a écrit :
> On Wed, Dec 03, 2014 at 06:20:59PM +0100, leroy christophe wrote:
>> Hi,
>>
>> When doing 'nft list ruleset', I get a bad result (see below),
>> fields appear as "unknown" and/or as numeric values.
> Please, test this:
>
> http://patchwork.ozlabs.org/patch/417775/
>
> and confirm that this resolves your problem. Thank you.
>

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html