Re: [PATCH nft] netlink_linearize: size nat register allocation by address expression

Pablo Neira Ayuso <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <aobh7eQw-eqF1iQI@chamomile>
On Thu, Aug 06, 2026 at 08:50:20PM +0200, Adrian Moisey wrote:
> nat statements with a literal concatenation of address and port, e.g.
> 
>   dnat ip6 addr . port to fd00:10:244::4 . 6443
> 
> allocated a fixed 128-bit register block for the address, but the ip6
> address . port concatenation is 144 bits (5 registers), so
> netlink_gen_concat overran into unallocated registers and hit the
> assertion 'dreg < ctx->reg_low' in netlink_gen_expr. IPv4 escaped by
> luck since its 48-bit concatenation fits into the padded block.
> 
> Allocate the register based on the address expression instead, which
> sizes by expr->len for concatenations, and add the matching
> release_register() call. Extend the nat_addr_port test with literal
> concatenation rules for ip and ip6.

Applied, thanks
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.