diff options
author | Phil Sutter <phil@nwl.cc> | 2022-12-01 15:16:43 +0100 |
---|---|---|
committer | Phil Sutter <phil@nwl.cc> | 2022-12-02 01:47:32 +0100 |
commit | ba1c0fe89eb56f8bf25f9165f2e5dc366ea0118c (patch) | |
tree | d5b03ef3a196917920d0935129974c3171f94a39 /extensions | |
parent | 29387a190f5ba04fb8a902dce9602292979a9ba2 (diff) |
xtables-translate: Fix for interfaces with asterisk mid-string
For nft, asterisk is special at end of the interface name only. Escaping
it mid-string makes the escape char part of the interface name, so avoid
this.
In the test case, also drop the ticks around interface names in
*-translate command - since there's no shell involved which would eat
them, they become part of the interface name.
Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions')
-rw-r--r-- | extensions/generic.txlate | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/extensions/generic.txlate b/extensions/generic.txlate index 7e879fd5..d7ddf6a3 100644 --- a/extensions/generic.txlate +++ b/extensions/generic.txlate @@ -74,17 +74,17 @@ ebtables-translate -I INPUT -p ! Length nft 'insert rule bridge filter INPUT ether type >= 0x0600 counter' # asterisk is not special in iptables and it is even a valid interface name -iptables-translate -A FORWARD -i '*' -o 'eth*foo' -nft 'add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter' +iptables-translate -A FORWARD -i * -o eth*foo +nft 'add rule ip filter FORWARD iifname "\*" oifname "eth*foo" counter' -# escape all asterisks but translate only the first plus character -iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++' -nft 'add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter' +# escape only suffix asterisk and translate only the last plus character +iptables-translate -A FORWARD -i eth*foo*+ -o eth++ +nft 'add rule ip filter FORWARD iifname "eth*foo**" oifname "eth+*" counter' # skip for always matching interface names -iptables-translate -A FORWARD -i '+' +iptables-translate -A FORWARD -i + nft 'add rule ip filter FORWARD counter' # match against invalid interface name to simulate never matching rule -iptables-translate -A FORWARD ! -i '+' +iptables-translate -A FORWARD ! -i + nft 'add rule ip filter FORWARD iifname "INVAL/D" counter' |