summaryrefslogtreecommitdiffstats
path: root/iptables/nft-ipv6.c
diff options
context:
space:
mode:
authorArturo Borrero <arturo.borrero.glez@gmail.com>2014-11-12 13:00:12 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2014-11-12 13:16:57 +0100
commitc82bf9f79bbc299de428fdc2e204d571b6cbc50d (patch)
tree984f4940c32af3d41e1598545a1e4e4b4b321659 /iptables/nft-ipv6.c
parentdf3741332d86629a8fdd267930e0a249803f6aa8 (diff)
iptables-compat: kill add_*() invflags parameter
Let's kill the invflags parameter and use directly NFT_CMP_[N]EQ. The caller must calculate which kind of cmp operation requires. BTW, this patch solves absence of inversion in some arptables-compat builtin matches. Thus, translating arptables inv flags is no longer needed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft-ipv6.c')
-rw-r--r--iptables/nft-ipv6.c26
1 files changed, 18 insertions, 8 deletions
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 5489398a..37365da1 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -20,6 +20,7 @@
#include <xtables.h>
+#include <linux/netfilter/nf_tables.h>
#include "nft.h"
#include "nft-shared.h"
@@ -27,26 +28,35 @@ static int nft_ipv6_add(struct nft_rule *r, void *data)
{
struct iptables_command_state *cs = data;
struct xtables_rule_match *matchp;
+ uint32_t op;
- if (cs->fw6.ipv6.iniface[0] != '\0')
- add_iniface(r, cs->fw6.ipv6.iniface, cs->fw6.ipv6.invflags);
+ if (cs->fw6.ipv6.iniface[0] != '\0') {
+ op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN);
+ add_iniface(r, cs->fw6.ipv6.iniface, op);
+ }
- if (cs->fw6.ipv6.outiface[0] != '\0')
- add_outiface(r, cs->fw6.ipv6.outiface, cs->fw6.ipv6.invflags);
+ if (cs->fw6.ipv6.outiface[0] != '\0') {
+ op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_OUT);
+ add_outiface(r, cs->fw6.ipv6.outiface, op);
+ }
- if (cs->fw6.ipv6.proto != 0)
+ if (cs->fw6.ipv6.proto != 0) {
+ op = nft_invflags2cmp(cs->fw6.ipv6.invflags, XT_INV_PROTO);
add_proto(r, offsetof(struct ip6_hdr, ip6_nxt), 1,
- cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags);
+ cs->fw6.ipv6.proto, op);
+ }
if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.src)) {
+ op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_SRCIP);
add_addr(r, offsetof(struct ip6_hdr, ip6_src),
&cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
- sizeof(struct in6_addr), cs->fw6.ipv6.invflags);
+ sizeof(struct in6_addr), op);
}
if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.dst)) {
+ op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_DSTIP);
add_addr(r, offsetof(struct ip6_hdr, ip6_dst),
&cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
- sizeof(struct in6_addr), cs->fw6.ipv6.invflags);
+ sizeof(struct in6_addr), op);
}
add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags);