netlink_linearize: use u64 conversion for 64bit quantities

nft generated two 4-byte swaps for conntrack byte/packet counters,
which are 64bit host-endian values:

byteorder reg 1 = hton(reg 1, 4, 8) ]

This makes the kernel perform two htonl() calls, but we need
a cpu_to_be64 conversion instead (reg 1, 8, 8).

Without this a rule like 'ct original packets > 10'
matched when counter was between 1 and 10.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index 48f5f0273cc2a0cdda002bde7e9020deb5aec85e..c77c462bb6fa5a6fced0c575d0b80607e71f36aa 100644 (file)
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -592,6 +592,14 @@ static void netlink_gen_unary(struct netlink_linearize_ctx *ctx,
                              enum nft_registers dreg)
 {
        struct nftnl_expr *nle;
+       int byte_size;
+
+       if ((expr->arg->len % 64) == 0)
+               byte_size = 8;
+       else if ((expr->arg->len % 32) == 0)
+               byte_size = 4;
+       else
+               byte_size = 2;
 
        netlink_gen_expr(ctx, expr->arg, dreg);
 
@@ -601,7 +609,7 @@ static void netlink_gen_unary(struct netlink_linearize_ctx *ctx,
        nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_LEN,
                           expr->len / BITS_PER_BYTE);
        nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_SIZE,
-                          expr->arg->len % 32 ? 2 : 4);
+                          byte_size);
        nftnl_expr_set_u32(nle, NFTNL_EXPR_BYTEORDER_OP,
                           netlink_gen_unary_op(expr->op));
        nftnl_rule_add_expr(ctx->nlr, nle);