diff options
| author | Phil Sutter <phil@nwl.cc> | 2021-03-02 14:50:07 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2021-03-09 09:27:33 +0100 |
| commit | 46f9d3a9a61ee80fa94b7fa7b3b36045c92606ae (patch) | |
| tree | f14a80399d455fe8a40812449decd394021c62de /iptables/nft-ipv6.c | |
| parent | 330f5df03ad589b46865ceedf2a54cf10a4225ba (diff) | |
xtables-translate: Fix translation of odd netmasks
Iptables supports netmasks which are not prefixes to match on (or
ignore) arbitrary bits in an address. Yet nftables' prefix notation is
available for real prefixes only, so translation is not as trivial -
print bitmask syntax for those cases.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'iptables/nft-ipv6.c')
| -rw-r--r-- | iptables/nft-ipv6.c | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index 130ad3e6..46008fc5 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -337,14 +337,27 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr, const struct in6_addr *mask, int invert, struct xt_xlate *xl) { + const char *op = invert ? "!= " : ""; char addr_str[INET6_ADDRSTRLEN]; + int cidr; - if (!invert && IN6_IS_ADDR_UNSPECIFIED(addr)) + if (!invert && IN6_IS_ADDR_UNSPECIFIED(addr) && IN6_IS_ADDR_UNSPECIFIED(mask)) return; inet_ntop(AF_INET6, addr, addr_str, INET6_ADDRSTRLEN); - xt_xlate_add(xl, "%s %s%s%s ", selector, invert ? "!= " : "", addr_str, - xtables_ip6mask_to_numeric(mask)); + cidr = xtables_ip6mask_to_cidr(mask); + switch (cidr) { + case -1: + xt_xlate_add(xl, "%s & %s %s %s ", selector, + xtables_ip6addr_to_numeric(mask), + invert ? "!=" : "==", addr_str); + break; + case 128: + xt_xlate_add(xl, "%s %s%s ", selector, op, addr_str); + break; + default: + xt_xlate_add(xl, "%s %s%s/%d ", selector, op, addr_str, cidr); + } } static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) |