diff options
| author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-10-07 19:08:53 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-14 18:59:35 +0200 |
| commit | 82dc0ce50d2f48369f6e738f165f9187012d5a82 (patch) | |
| tree | 2e45fa139bfb2845abaed02fa15b95145173d272 /extensions | |
| parent | cd33256280d085834bd0fe674afc446364143d3c (diff) | |
extensions: libxt_ipcomp: add range support in translation
When translate to nft rules, ipcompspi range is not supported, so:
# iptables-translate -A OUTPUT -m ipcomp --ipcompspi 1:2
nft add rule ip filter OUTPUT comp cpi 1 counter
# iptables-translate -A OUTPUT -m ipcomp ! --ipcompspi 3:30
nft add rule ip filter OUTPUT comp cpi != 3 counter
Apply this patch:
# iptables-translate -A OUTPUT -m ipcomp --ipcompspi 1:2
nft add rule ip filter OUTPUT comp cpi 1-2 counter
# iptables-translate -A OUTPUT -m ipcomp ! --ipcompspi 3:30
nft add rule ip filter OUTPUT comp cpi != 3-30 counter
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions')
| -rw-r--r-- | extensions/libxt_ipcomp.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c index 9f7c0ef5..b5c43128 100644 --- a/extensions/libxt_ipcomp.c +++ b/extensions/libxt_ipcomp.c @@ -101,9 +101,13 @@ static int comp_xlate(struct xt_xlate *xl, const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)params->match->data; - xt_xlate_add(xl, "comp cpi %s%u", - (compinfo->invflags & XT_IPCOMP_INV_SPI) ? "!= " : "", - compinfo->spis[0]); + xt_xlate_add(xl, "comp cpi %s", + compinfo->invflags & XT_IPCOMP_INV_SPI ? "!= " : ""); + if (compinfo->spis[0] != compinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", compinfo->spis[0], + compinfo->spis[1]); + else + xt_xlate_add(xl, "%u", compinfo->spis[0]); return 1; } |