diff options
| author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-07-30 13:20:59 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-01 14:21:27 +0200 |
| commit | 0ddd663e9c167f9f0451dac8c02bbfcda25fe15e (patch) | |
| tree | cf45f737d411decb39d13c4bec30a3872a94f7f9 /iptables/xtables-translate.c | |
| parent | 68c57e809f69108694cce2d502a3ed1c328d13e8 (diff) | |
iptables-translate: add in/out ifname wildcard match translation to nft
In iptables, "-i eth+" means match all in ifname with the prefix "eth".
But in nftables, this was changed to "iifname eth*". So we should handle
this subtle difference.
Apply this patch, translation will become:
# iptables-translate -A INPUT -i eth+
nft add rule ip filter INPUT iifname eth* counter
# ip6tables-translate -A OUTPUT ! -o eth+
nft add rule ip6 filter OUTPUT oifname != eth* counter
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/xtables-translate.c')
| -rw-r--r-- | iptables/xtables-translate.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c index 9044d27c..3c577ed2 100644 --- a/iptables/xtables-translate.c +++ b/iptables/xtables-translate.c @@ -34,6 +34,23 @@ #include "xshared.h" #include "nft-shared.h" +void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + bool invert) +{ + char iface[IFNAMSIZ]; + int ifaclen; + + if (ifname[0] == '\0') + return; + + strcpy(iface, ifname); + ifaclen = strlen(iface); + if (iface[ifaclen - 1] == '+') + iface[ifaclen - 1] = '*'; + + xt_xlate_add(xl, "%s %s%s ", nftmeta, invert ? "!= " : "", iface); +} + int xlate_action(const struct iptables_command_state *cs, bool goto_set, struct xt_xlate *xl) { |