diff options
author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-07-30 13:20:59 +0800 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-01 14:21:27 +0200 |
commit | 0ddd663e9c167f9f0451dac8c02bbfcda25fe15e (patch) | |
tree | cf45f737d411decb39d13c4bec30a3872a94f7f9 /iptables/nft-ipv4.c | |
parent | 68c57e809f69108694cce2d502a3ed1c328d13e8 (diff) |
iptables-translate: add in/out ifname wildcard match translation to nft
In iptables, "-i eth+" means match all in ifname with the prefix "eth".
But in nftables, this was changed to "iifname eth*". So we should handle
this subtle difference.
Apply this patch, translation will become:
# iptables-translate -A INPUT -i eth+
nft add rule ip filter INPUT iifname eth* counter
# ip6tables-translate -A OUTPUT ! -o eth+
nft add rule ip6 filter OUTPUT oifname != eth* counter
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft-ipv4.c')
-rw-r--r-- | iptables/nft-ipv4.c | 14 |
1 files changed, 4 insertions, 10 deletions
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 814ca14d..50706cb0 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -444,16 +444,10 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) const char *comment; int ret; - if (cs->fw.ip.iniface[0] != '\0') { - xt_xlate_add(xl, "iifname %s%s ", - cs->fw.ip.invflags & IPT_INV_VIA_IN ? "!= " : "", - cs->fw.ip.iniface); - } - if (cs->fw.ip.outiface[0] != '\0') { - xt_xlate_add(xl, "oifname %s%s ", - cs->fw.ip.invflags & IPT_INV_VIA_OUT? "!= " : "", - cs->fw.ip.outiface); - } + xlate_ifname(xl, "iifname", cs->fw.ip.iniface, + cs->fw.ip.invflags & IPT_INV_VIA_IN); + xlate_ifname(xl, "oifname", cs->fw.ip.outiface, + cs->fw.ip.invflags & IPT_INV_VIA_OUT); if (cs->fw.ip.flags & IPT_F_FRAG) { xt_xlate_add(xl, "ip frag-off %s%x ", |