diff options
| author | Phil Sutter <phil@nwl.cc> | 2024-02-01 15:45:42 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2024-02-02 18:26:14 +0100 |
| commit | a0e5dad34a6410e4960feb621780c4b06f374477 (patch) | |
| tree | 04cd7b39efbf501500499ef6f40b4e6016aa7fb8 /extensions/libip6t_rt.txlate | |
| parent | 83f60fb37d594d1984a4e8a197d8f99eb8b2db30 (diff) | |
extensions: rt: Save/xlate inverted full ranges
Also translate plain '-m rt' match into an exthdr exists one.
Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libip6t_rt.txlate')
| -rw-r--r-- | extensions/libip6t_rt.txlate | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate index 67d88d07..1c2f74a5 100644 --- a/extensions/libip6t_rt.txlate +++ b/extensions/libip6t_rt.txlate @@ -17,7 +17,7 @@ ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT -nft 'add rule ip6 filter INPUT counter accept' +nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT -nft 'add rule ip6 filter INPUT counter accept' +nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' |