diff options
| -rw-r--r-- | iptables/nft-ipv4.c | 10 | ||||
| -rw-r--r-- | iptables/nft-ipv6.c | 8 |
2 files changed, 11 insertions, 7 deletions
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 295dd425..52b1bed2 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -471,14 +471,16 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) } if (cs->fw.ip.src.s_addr != 0) { - xt_xlate_add(xl, "ip saddr %s%s ", + xt_xlate_add(xl, "ip saddr %s%s%s ", cs->fw.ip.invflags & IPT_INV_SRCIP ? "!= " : "", - inet_ntoa(cs->fw.ip.src)); + inet_ntoa(cs->fw.ip.src), + xtables_ipmask_to_numeric(&cs->fw.ip.smsk)); } if (cs->fw.ip.dst.s_addr != 0) { - xt_xlate_add(xl, "ip daddr %s%s ", + xt_xlate_add(xl, "ip daddr %s%s%s ", cs->fw.ip.invflags & IPT_INV_DSTIP ? "!= " : "", - inet_ntoa(cs->fw.ip.dst)); + inet_ntoa(cs->fw.ip.dst), + xtables_ipmask_to_numeric(&cs->fw.ip.dmsk)); } ret = xlate_matches(cs, xl); diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index 8bebf6be..c475b8e9 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -387,6 +387,7 @@ static void nft_ipv6_save_counters(const void *data) } static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr, + const struct in6_addr *mask, int invert, struct xt_xlate *xl) { char addr_str[INET6_ADDRSTRLEN]; @@ -395,7 +396,8 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr, return; inet_ntop(AF_INET6, addr, addr_str, INET6_ADDRSTRLEN); - xt_xlate_add(xl, "%s %s%s ", selector, invert ? "!= " : "", addr_str); + xt_xlate_add(xl, "%s %s%s%s ", selector, invert ? "!= " : "", addr_str, + xtables_ip6mask_to_numeric(mask)); } static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) @@ -425,9 +427,9 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) } } - xlate_ipv6_addr("ip6 saddr", &cs->fw6.ipv6.src, + xlate_ipv6_addr("ip6 saddr", &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk, cs->fw6.ipv6.invflags & IP6T_INV_SRCIP, xl); - xlate_ipv6_addr("ip6 daddr", &cs->fw6.ipv6.dst, + xlate_ipv6_addr("ip6 daddr", &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk, cs->fw6.ipv6.invflags & IP6T_INV_DSTIP, xl); ret = xlate_matches(cs, xl); |