diff options
| author | Phil Sutter <phil@nwl.cc> | 2021-05-04 16:03:24 +0200 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2021-05-19 09:53:14 +0200 |
| commit | a61282ec6a1697bfb40f19d13a28a74559050167 (patch) | |
| tree | 65121dad3f628c0719d9c811b8ca63eda45d4f1d | |
| parent | 556f704458cdb509d395ddb7d2629987d60e762e (diff) | |
extensions: sctp: Fix nftables translation
If both sport and dport was present, incorrect nft syntax was generated.
Fixes: defc7bd2bac89 ("extensions: libxt_sctp: Add translation to nft")
Signed-off-by: Phil Sutter <phil@nwl.cc>
| -rw-r--r-- | extensions/libxt_sctp.c | 10 | ||||
| -rw-r--r-- | extensions/libxt_sctp.txlate | 10 |
2 files changed, 9 insertions, 11 deletions
diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c index 140de265..ee4e99eb 100644 --- a/extensions/libxt_sctp.c +++ b/extensions/libxt_sctp.c @@ -495,15 +495,13 @@ static int sctp_xlate(struct xt_xlate *xl, if (!einfo->flags) return 0; - xt_xlate_add(xl, "sctp "); - if (einfo->flags & XT_SCTP_SRC_PORTS) { if (einfo->spts[0] != einfo->spts[1]) - xt_xlate_add(xl, "sport%s %u-%u", + xt_xlate_add(xl, "sctp sport%s %u-%u", einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", einfo->spts[0], einfo->spts[1]); else - xt_xlate_add(xl, "sport%s %u", + xt_xlate_add(xl, "sctp sport%s %u", einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", einfo->spts[0]); space = " "; @@ -511,11 +509,11 @@ static int sctp_xlate(struct xt_xlate *xl, if (einfo->flags & XT_SCTP_DEST_PORTS) { if (einfo->dpts[0] != einfo->dpts[1]) - xt_xlate_add(xl, "%sdport%s %u-%u", space, + xt_xlate_add(xl, "%ssctp dport%s %u-%u", space, einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", einfo->dpts[0], einfo->dpts[1]); else - xt_xlate_add(xl, "%sdport%s %u", space, + xt_xlate_add(xl, "%ssctp dport%s %u", space, einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", einfo->dpts[0]); } diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate index 72f4641a..0d6c59e1 100644 --- a/extensions/libxt_sctp.txlate +++ b/extensions/libxt_sctp.txlate @@ -23,16 +23,16 @@ iptables-translate -A INPUT -p sctp ! --dport 50:56 -j ACCEPT nft add rule ip filter INPUT sctp dport != 50-56 counter accept iptables-translate -A INPUT -p sctp --dport 80 --sport 50 -j ACCEPT -nft add rule ip filter INPUT sctp sport 50 dport 80 counter accept +nft add rule ip filter INPUT sctp sport 50 sctp dport 80 counter accept iptables-translate -A INPUT -p sctp --dport 80:100 --sport 50 -j ACCEPT -nft add rule ip filter INPUT sctp sport 50 dport 80-100 counter accept +nft add rule ip filter INPUT sctp sport 50 sctp dport 80-100 counter accept iptables-translate -A INPUT -p sctp --dport 80 --sport 50:55 -j ACCEPT -nft add rule ip filter INPUT sctp sport 50-55 dport 80 counter accept +nft add rule ip filter INPUT sctp sport 50-55 sctp dport 80 counter accept iptables-translate -A INPUT -p sctp ! --dport 80:100 --sport 50 -j ACCEPT -nft add rule ip filter INPUT sctp sport 50 dport != 80-100 counter accept +nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT -nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept +nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept |