From: Anders K. Pedersen <a...@cohaesio.com>
I noticed that while
# nft add rule ip6 filter postrouting \
flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \}
works, the opposite order for the concatenated expressions fails:
# nft add rule ip6 filter postrouting \
flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \}
nft: netlink_linearize.c:634: netlink_gen_expr: Assertion `dreg <
ctx->reg_low' failed.
I traced this down to get_register() and release_register(), where the
EXPR_CONCAT handling isn't hit, when it's embedded in EXPR_SET_ELEM, and
fixed it similarly to how EXPR_SET_ELEM is handled in netlink_gen_expr().
Signed-off-by: Anders K. Pedersen <a...@cohaesio.com>
---
src/netlink_linearize.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -73,6 +73,9 @@ static void __release_register(struct netlink_linearize_ctx
*ctx,
static enum nft_registers get_register(struct netlink_linearize_ctx *ctx,
const struct expr *expr)
{
+ if (expr && expr->ops->type == EXPR_SET_ELEM)
+ return get_register(ctx, expr->key);
+
if (expr && expr->ops->type == EXPR_CONCAT)
return __get_register(ctx, expr->len);
else
@@ -82,6 +85,9 @@ static enum nft_registers get_register(struct
netlink_linearize_ctx *ctx,
static void release_register(struct netlink_linearize_ctx *ctx,
const struct expr *expr)
{
+ if (expr && expr->ops->type == EXPR_SET_ELEM)
+ return release_register(ctx, expr->key);
+
if (expr && expr->ops->type == EXPR_CONCAT)
__release_register(ctx, expr->len);
else
