From f035be35c749d5c5cbb7ffdbcd1c548b91bd3033 Mon Sep 17 00:00:00 2001 From: "Pablo M. Bermudo Garay" Date: Sat, 9 Jul 2016 12:27:51 +0200 Subject: xtables-translate: fix multiple spaces issue This patch fixes a multiple spaces issue. The problem arises when a rule set loaded through iptables-compat-restore is listed in nft. Before this commit, two spaces were printed after every match translation: $ sudo iptables-save *filter :INPUT ACCEPT [0:0] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m multiport --dports 80:85 -m ttl --ttl-gt 5 -j ACCEPT COMMIT $ sudo iptables-compat-restore iptables-save $ sudo nft list ruleset table ip filter { chain INPUT { type filter hook input priority 0; policy accept; ct state related,established counter packets 0 bytes 0 accept ^^ ip protocol tcp tcp dport 80-85 ip ttl gt 5 counter packets 0 bytes 0 accept ^^ ^^ } } Signed-off-by: Pablo M. Bermudo Garay Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_tcp.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'extensions/libxt_tcp.c') diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c index 2a14035d..bc1d0af6 100644 --- a/extensions/libxt_tcp.c +++ b/extensions/libxt_tcp.c @@ -397,33 +397,36 @@ static int tcp_xlate(const void *ip, const struct xt_entry_match *match, struct xt_xlate *xl, int numeric) { const struct xt_tcp *tcpinfo = (const struct xt_tcp *)match->data; + char *space= ""; if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { if (tcpinfo->spts[0] != tcpinfo->spts[1]) { - xt_xlate_add(xl, "tcp sport %s%u-%u ", + xt_xlate_add(xl, "tcp sport %s%u-%u", tcpinfo->invflags & XT_TCP_INV_SRCPT ? "!= " : "", tcpinfo->spts[0], tcpinfo->spts[1]); } else { - xt_xlate_add(xl, "tcp sport %s%u ", + xt_xlate_add(xl, "tcp sport %s%u", tcpinfo->invflags & XT_TCP_INV_SRCPT ? "!= " : "", tcpinfo->spts[0]); } + space = " "; } if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { - xt_xlate_add(xl, "tcp dport %s%u-%u ", + xt_xlate_add(xl, "%stcp dport %s%u-%u", space, tcpinfo->invflags & XT_TCP_INV_DSTPT ? "!= " : "", tcpinfo->dpts[0], tcpinfo->dpts[1]); } else { - xt_xlate_add(xl, "tcp dport %s%u ", + xt_xlate_add(xl, "%stcp dport %s%u", space, tcpinfo->invflags & XT_TCP_INV_DSTPT ? "!= " : "", tcpinfo->dpts[0]); } + space = " "; } /* XXX not yet implemented */ @@ -431,12 +434,11 @@ static int tcp_xlate(const void *ip, const struct xt_entry_match *match, return 0; if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { - xt_xlate_add(xl, "tcp flags & "); + xt_xlate_add(xl, "%stcp flags & ", space); print_tcp_xlate(xl, tcpinfo->flg_mask); xt_xlate_add(xl, " %s ", tcpinfo->invflags & XT_TCP_INV_FLAGS ? "!=": "=="); print_tcp_xlate(xl, tcpinfo->flg_cmp); - xt_xlate_add(xl, " "); } return 1; -- cgit v1.2.3