diff options
| -rw-r--r-- | extensions/libxt_comment.c | 13 | ||||
| -rw-r--r-- | include/xtables.h | 1 | ||||
| -rw-r--r-- | iptables/nft-ipv4.c | 5 | ||||
| -rw-r--r-- | iptables/nft-ipv6.c | 5 | ||||
| -rw-r--r-- | libxtables/xtables.c | 5 |
5 files changed, 29 insertions, 0 deletions
diff --git a/extensions/libxt_comment.c b/extensions/libxt_comment.c index 6ed2ff9b..3fcb8b46 100644 --- a/extensions/libxt_comment.c +++ b/extensions/libxt_comment.c @@ -48,6 +48,18 @@ comment_save(const void *ip, const struct xt_entry_match *match) xtables_save_string(commentinfo->comment); } +static int +comment_xlate(const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + struct xt_comment_info *commentinfo = (void *)match->data; + + commentinfo->comment[XT_MAX_COMMENT_LEN - 1] = '\0'; + xt_xlate_add_comment(xl, commentinfo->comment); + + return 1; +} + static struct xtables_match comment_match = { .family = NFPROTO_UNSPEC, .name = "comment", @@ -59,6 +71,7 @@ static struct xtables_match comment_match = { .save = comment_save, .x6_parse = xtables_option_parse, .x6_options = comment_opts, + .xlate = comment_xlate, }; void _init(void) diff --git a/include/xtables.h b/include/xtables.h index 6fd3bdfc..e219c9f9 100644 --- a/include/xtables.h +++ b/include/xtables.h @@ -574,6 +574,7 @@ struct xt_xlate *xt_xlate_alloc(int size); void xt_xlate_free(struct xt_xlate *xl); void xt_xlate_add(struct xt_xlate *xl, const char *fmt, ...); void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment); +const char *xt_xlate_get_comment(struct xt_xlate *xl); const char *xt_xlate_get(struct xt_xlate *xl); #ifdef XTABLES_INTERNAL diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 5e2857d3..cf985b73 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -432,6 +432,7 @@ static void nft_ipv4_save_counters(const void *data) static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) { const struct iptables_command_state *cs = data; + const char *comment; int ret; if (cs->fw.ip.iniface[0] != '\0') { @@ -484,6 +485,10 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) /* Always add counters per rule, as in iptables */ xt_xlate_add(xl, "counter "); + comment = xt_xlate_get_comment(xl); + if (comment) + xt_xlate_add(xl, "comment \\\"%s\\\" ", comment); + ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); return ret; diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index 0ee79575..92d37a02 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -392,6 +392,7 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr, static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) { const struct iptables_command_state *cs = data; + const char *comment; int ret; if (cs->fw6.ipv6.iniface[0] != '\0') { @@ -435,6 +436,10 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) /* Always add counters per rule, as in iptables */ xt_xlate_add(xl, "counter "); + comment = xt_xlate_get_comment(xl); + if (comment) + xt_xlate_add(xl, "comment \\\"%s\\\" ", comment); + ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl); return ret; diff --git a/libxtables/xtables.c b/libxtables/xtables.c index c4b86f51..fe24caa2 100644 --- a/libxtables/xtables.c +++ b/libxtables/xtables.c @@ -2045,6 +2045,11 @@ void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment) xl->comment[NFT_USERDATA_MAXLEN - 1] = '\0'; } +const char *xt_xlate_get_comment(struct xt_xlate *xl) +{ + return xl->comment[0] ? xl->comment : NULL; +} + const char *xt_xlate_get(struct xt_xlate *xl) { return xl->buf.data; |