https://bugzilla.netfilter.org/show_bug.cgi?id=918
Summary: Ranges and comparat
Product: nftables
Version: unspecified
Platform: x86_64
OS/Version: Debian GNU/Linux
Status: NEW
Severity: normal
Priority: P5
Component: nft
AssignedTo: pablo at netfilter.org
ReportedBy: anarey at gmail.com
Estimated Hours: 0.0
There is a problem with ranges and comparisons. Here some examples of this bug.
With ttl:
$ sudo nft add rule ip test input ip ttl 13-15 counter drop
BUG: invalid byte order conversion 0 => 2
nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed.
nft add rule ip test input ip ttl lt 9 counter drop
BUG: invalid byte order conversion 0 => 2
nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed.
$ sudo nft add rule ip test input ip ttl gt 9 counter drop
BUG: invalid byte order conversion 0 => 2
nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed.
With ah in ipv4
$ sudo nft add rule ip test input ah spi 500-550 counter drop
BUG: invalid byte order conversion 0 => 2
nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed.
With ah in IPv6
* spi (ipv6)
$ sudo nft add rule ip6 test6 input ah spi 500-550 counter drop
BUG: invalid byte order conversion 0 => 2
nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed.
With esp in spi:
$ sudo nft add rule ip test input esp spi 500-550 counter drop
BUG: invalid byte order conversion 0 => 2
nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed.
I can always reproduce this bug in these cases.
The last commit in Pablo git tree of kernel is "40e6442 netfilter:
x_tables:
allow to use cgroup match for LOCAL_IN nf hooks"
The last commit in libmnl repo is "090a842 examples: use
mnl_socket_setsockopt"
The last commit in libnftnl repo is "57107c2 common: fix unconditional
output
of event wrapping stuff"
The last commit in nftables repo is "aefa9bf expression: Fix inconsistent
output in set"
--
Configure bugmail: https://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.