From: Liping Zhang Date: Wed, 1 Jun 2016 12:07:17 +0000 (+0800) Subject: extensions: libxt_mark: fix a wrong translation to nft when mask is specified X-Git-Tag: v1.6.1~83 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8548dd253833027c68ac6400c3118ef788fabe5d;p=thirdparty%2Fiptables.git extensions: libxt_mark: fix a wrong translation to nft when mask is specified The mask and mark's order is reversed, so when we specify the mask, we will get the wrong translation result: # iptables-translate -A INPUT -m mark --mark 0x1/0xff nft add rule ip filter INPUT mark and 0x1 == 0xff counter Apply this patch, translation will become: # iptables-translate -A INPUT -m mark --mark 0x1/0xff nft add rule ip filter INPUT mark and 0xff == 0x1 counter Cc: Shivani Bhardwaj Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso --- diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c index 939b4acd..6eccd5b3 100644 --- a/extensions/libxt_mark.c +++ b/extensions/libxt_mark.c @@ -107,8 +107,8 @@ print_mark_xlate(struct xt_xlate *xl, unsigned int mark, unsigned int mask, uint32_t op) { if (mask != 0xffffffffU) - xt_xlate_add(xl, " and 0x%x %s 0x%x ", mark, - op == XT_OP_EQ ? "==" : "!=", mask); + xt_xlate_add(xl, " and 0x%x %s 0x%x ", mask, + op == XT_OP_EQ ? "==" : "!=", mark); else xt_xlate_add(xl, " %s0x%x ", op == XT_OP_EQ ? "" : "!= ", mark);