From d007e1a59e4beaddab430992302d43b122ffc801 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 11 Feb 2014 13:58:03 +0100 Subject: nft-compat: fix IP6T_F_GOTO flag handling IPT_F_GOTO and IP6T_F_GOTO don't overlap, so this need special handling to avoid misinterpretations. Signed-off-by: Pablo Neira Ayuso --- iptables/nft-ipv4.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'iptables/nft-ipv4.c') diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 02645a29..d05e80eb 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -76,7 +76,7 @@ static int nft_ipv4_add(struct nft_rule *r, void *data) if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0) return -1; - return add_action(r, cs, cs->fw.ip.flags); + return add_action(r, cs, !!(cs->fw.ip.flags & IPT_F_GOTO)); } static bool nft_ipv4_is_same(const void *data_a, @@ -331,6 +331,12 @@ static void nft_ipv4_save_firewall(const void *data, unsigned int format) save_matches_and_target(cs->matches, cs->target, cs->jumpto, cs->fw.ip.flags, &cs->fw); + + if (cs->target == NULL && strlen(cs->jumpto) > 0) { + printf("-%c %s", cs->fw.ip.flags & IPT_F_GOTO ? 'g' : 'j', + cs->jumpto); + } + printf("\n"); } static void nft_ipv4_proto_parse(struct iptables_command_state *cs, -- cgit v1.2.3