diff options
author | Phil Sutter <phil@nwl.cc> | 2018-11-27 20:07:11 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-11-27 20:46:26 +0100 |
commit | ccf154d7420c07b6e6febc1c3b8b31d2bd1adbe6 (patch) | |
tree | f197af81ce1b071b2a34e8f563a02aec3f6daa00 /iptables/nft-ipv6.c | |
parent | 2ed6c85f8743a83d2b302bf6bd8d16b5efa3bb14 (diff) |
xtables: Don't use native nftables comments
The problem with converting libxt_comment into nftables comment is that
rules change when parsing from kernel due to comment match being moved
to the end of the match list. And since match ordering matters, the rule
may not be found anymore when checking or deleting. Apart from that,
iptables-nft didn't support multiple comments per rule anymore. This is
a compatibility issue without technical reason.
Leave conversion from nftables comment to libxt_comment in place so we
don't break running systems during an update.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft-ipv6.c')
-rw-r--r-- | iptables/nft-ipv6.c | 14 |
1 files changed, 3 insertions, 11 deletions
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index 7bacee4a..cacb1c9e 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -66,17 +66,9 @@ static int nft_ipv6_add(struct nftnl_rule *r, void *data) add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO); for (matchp = cs->matches; matchp; matchp = matchp->next) { - /* Use nft built-in comments support instead of comment match */ - if (strcmp(matchp->match->name, "comment") == 0) { - ret = add_comment(r, (char *)matchp->match->m->data); - if (ret < 0) - goto try_match; - } else { -try_match: - ret = add_match(r, matchp->match->m); - if (ret < 0) - return ret; - } + ret = add_match(r, matchp->match->m); + if (ret < 0) + return ret; } /* Counters need to me added before the target, otherwise they are |