Re: [PATCH nft] netlink_linearize: size nat register allocation by address expression
Pablo Neira Ayuso <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <aobh7eQw-eqF1iQI@chamomile> |
On Thu, Aug 06, 2026 at 08:50:20PM +0200, Adrian Moisey wrote: > nat statements with a literal concatenation of address and port, e.g. > > dnat ip6 addr . port to fd00:10:244::4 . 6443 > > allocated a fixed 128-bit register block for the address, but the ip6 > address . port concatenation is 144 bits (5 registers), so > netlink_gen_concat overran into unallocated registers and hit the > assertion 'dreg < ctx->reg_low' in netlink_gen_expr. IPv4 escaped by > luck since its 48-bit concatenation fits into the padded block. > > Allocate the register based on the address expression instead, which > sizes by expr->len for concatenations, and add the matching > release_register() call. Extend the nat_addr_port test with literal > concatenation rules for ip and ip6. Applied, thanks