diff options
-rw-r--r-- | extensions/generic.txlate | 2 | ||||
-rw-r--r-- | iptables/nft-bridge.c | 6 |
2 files changed, 4 insertions, 4 deletions
diff --git a/extensions/generic.txlate b/extensions/generic.txlate index d7ddf6a3..c24ed156 100644 --- a/extensions/generic.txlate +++ b/extensions/generic.txlate @@ -65,7 +65,7 @@ ebtables-translate -A FORWARD ! -i iname --logical-in ilogname -o out+ --logical nft 'add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oifname "out*" meta obrname "lout*" ether daddr 01:02:03:04:de:af counter' ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00 -nft 'insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter' +nft 'insert rule bridge filter INPUT ether type 0x800 ether daddr and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter' ebtables-translate -I INPUT -p Length nft 'insert rule bridge filter INPUT ether type < 0x0600 counter' diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index 8d002c17..e223d197 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -866,17 +866,17 @@ static void nft_bridge_xlate_mac(struct xt_xlate *xl, const char *type, bool inv xt_xlate_add(xl, "ether %s %s", type, invert ? "!= " : ""); - xlate_mac(xl, mac); - if (memcmp(mask, one_msk, ETH_ALEN)) { int i; - xt_xlate_add(xl, " and "); + xt_xlate_add(xl, "and"); xlate_mac(xl, mask); xt_xlate_add(xl, " == %02x", mac[0] & mask[0]); for (i=1; i < ETH_ALEN; i++) xt_xlate_add(xl, ":%02x", mac[i] & mask[i]); + } else { + xlate_mac(xl, mac); } } |