summaryrefslogtreecommitdiffstats
path: root/extensions/libxt_bpf.man
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2016-11-25 18:52:55 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2016-11-29 23:03:50 +0100
commitf1cd86ddcf1726b91aedb9ef916b380edc8c2b61 (patch)
tree635cf902880c1e5eb91c961b4792c2b098787940 /extensions/libxt_bpf.man
parent3531d7cc07d8121bcfd5379978d4d40c489c6dd5 (diff)
nft_ipv{4,6}_xlate: Respect prefix lengths
This was an annoying bug in the translator since it silently dropped crucial information which is easily overlooked: | $ iptables-translate -A INPUT -s 192.168.0.0/24 -j ACCEPT | nft add rule ip filter INPUT ip saddr 192.168.0.0 counter accept | $ ip6tables-translate -A INPUT -s feed:babe::/64 -j ACCEPT | nft add rule ip6 filter INPUT ip6 saddr feed:babe:: counter accept To my surprise, this fix works really well in all kinds of situations: | $ iptables-translate -A INPUT -s 1.2.3.4/0 -j ACCEPT | nft add rule ip filter INPUT counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/23 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.2.0/23 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/24 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.3.0/24 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/32 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.3.4 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/255.255.0.0 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.0.0/16 counter accept Ditto for IPv6. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_bpf.man')
0 files changed, 0 insertions, 0 deletions