diff options
| author | Shyam Saini <mayhs11saini@gmail.com> | 2017-01-26 14:49:50 +0530 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-01-26 17:11:58 +0100 |
| commit | 7df66f1c13563cfbab75246b009ce36f69ee4487 (patch) | |
| tree | 622afb3ff59e7306991d0c3c493591415fde9a8e | |
| parent | 96472f872800db05bb7d66db827dbd9c76e28ea6 (diff) | |
iptables: fix the wrong appending of jump verdict after the comment.v1.6.1
Fix wrong appending of jump verdict after the comment
For example:
$ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar"
nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT
Note that even without comment with double-quotes (i.e. --comment
"foobar"), it will add quotes:
$ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment
nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop
Attempting to apply the translated/generated rule will result to:
$ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT
<cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon
add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT
After this patch
$ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar"
nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\"
which is correct translation
Signed-off-by: Shyam Saini <mayhs11saini@gmail.com>
Reviewed-by: Shivani Bhardwaj <shivanib134@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | iptables/nft-ipv4.c | 5 | ||||
| -rw-r--r-- | iptables/nft-ipv6.c | 5 |
2 files changed, 4 insertions, 6 deletions
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 52b1bed2..e5947a7c 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -489,12 +489,11 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) /* Always add counters per rule, as in iptables */ xt_xlate_add(xl, "counter "); + ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); comment = xt_xlate_get_comment(xl); if (comment) - xt_xlate_add(xl, "comment %s", comment); - - ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); + xt_xlate_add(xl, " comment %s", comment); return ret; } diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index c475b8e9..9cf4058f 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -438,12 +438,11 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) /* Always add counters per rule, as in iptables */ xt_xlate_add(xl, "counter "); + ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl); comment = xt_xlate_get_comment(xl); if (comment) - xt_xlate_add(xl, "comment %s", comment); - - ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl); + xt_xlate_add(xl, " comment %s", comment); return ret; } |