summaryrefslogtreecommitdiffstats
path: root/iptables/nft-ipv4.c
Commit message (Collapse)AuthorAgeFilesLines
* nft: prepare for dynamic register allocationPablo Neira Ayuso2022-05-021-3/+5
| | | | | | | | | Store the register that has been allocated and pass it on to the next expression. NFT_REG_1 is still used. No functional changes are expected. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass handle to helper functions to build netlink payloadPablo Neira Ayuso2022-05-021-6/+6
| | | | | | | Pass struct nft_handle to helper functions in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass struct nft_xt_ctx to parse_meta()Pablo Neira Ayuso2022-05-021-1/+1
| | | | | | In preparation for native mark match support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Don't pass command state opaque to family ops callbacksPhil Sutter2022-03-101-17/+11
| | | | | | | | | | | There are no family-specific versions of struct iptables_command_state anymore, so no need to hide it behind void pointer. Pass the type as-is and save a few casts. While at it, drop unused callbacks parse_bitwise and parse_cmp. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Simplify immediate parsingPhil Sutter2022-03-101-9/+3
| | | | | | | | | | Implementations of parse_immediate callback are mostly trivial, the only relevant part is access to family-specific parts of struct iptables_command_state when setting goto flag for iptables and ip6tables. Refactor them into simple set_goto_flag callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Move proto_parse and post_parse callbacks to xsharedPhil Sutter2022-01-121-57/+2
| | | | | | | They are not nft-variant-specific and may therefore be shared with legacy. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Do not pass nft_handle to do_parse()Phil Sutter2022-01-121-2/+4
| | | | | | | | | Make it fit for sharing with legacy iptables, drop nft-specific parameter. This requires to mirror proto_parse and post_parse callbacks from family_ops somewhere reachable - use xt_cmd_parse, it holds other "parser setup data" as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_fragment() with legacyPhil Sutter2021-11-231-14/+1
| | | | | | | | | | | Also add a fake mode to make it suitable for ip6tables. This is required because IPT_F_FRAG value clashes with IP6T_F_PROTO, so ip6tables rules might seem to have IPT_F_FRAG bit set. While being at it, drop the local variable 'flags' from print_firewall(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_rule_details() with legacyPhil Sutter2021-11-231-2/+2
| | | | | | | | | | Have to pass pointer to counters directly since different fields are being used for some reason. Since proto_to_name() is not used outside of xshared.c anymore, make it static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share save_ipv{4,6}_addr() with legacyPhil Sutter2021-11-231-41/+2
| | | | | | | While being at it, make save_ipv4_addr() accept an in_addr* as mask - mask_to_str() needs it anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share save_rule_details() with legacyPhil Sutter2021-11-231-9/+4
| | | | | | | | | | The function combines printing of input and output interfaces and protocol parameter, all being IP family independent. Extend the function to print fragment option ('-f'), too if requested. While being at it, drop unused iptables_command_state parameter and reorder the remaining ones a bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Change whitespace printing in save_rule callbackPhil Sutter2021-11-231-3/+3
| | | | | | | This aligns whitespace printing with legacy iptables' print_rule4() in order to prepare for further code-sharing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Add family ops callbacks wrapping different nft_cmd_* functionsPhil Sutter2021-10-201-0/+93
| | | | | | | | | | Commands supporting multiple source/destination addresses need to iterate over them and call the respective nft_cmd_* function multiple times. These loops are family-specific though as each family uses a different data structure within struct iptables_command_state to store the addresses. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Avoid buffer size warnings copying iface namesPhil Sutter2021-06-071-2/+2
| | | | | | | | | The call to strncpy() is actually not needed: source buffer is only IFNAMSIZ bytes large and guaranteed to be null-terminated. Use this to avoid compiler warnings due to size parameter matching the destination buffer size by performing the copy using (dumb) memcpy() instead. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Eliminate inet_aton() and inet_ntoa()Phil Sutter2021-04-301-9/+14
| | | | | | | Both functions are obsolete, replace them by equivalent calls to inet_pton() and inet_ntop(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix translation of odd netmasksPhil Sutter2021-03-091-12/+30
| | | | | | | | | Iptables supports netmasks which are not prefixes to match on (or ignore) arbitrary bits in an address. Yet nftables' prefix notation is available for real prefixes only, so translation is not as trivial - print bitmask syntax for those cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Optimize masked MAC address matchesPhil Sutter2020-11-041-2/+4
| | | | | | | | | | Just like with class-based prefix matches in iptables-nft, optimize masked MAC address matches if the mask is on a byte-boundary. To reuse the logic in add_addr(), extend it to accept the payload base value via parameter. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Optimize class-based IP prefix matchesPhil Sutter2020-11-041-2/+4
| | | | | | | Payload expression works on byte-boundaries, leverage this with suitable prefix lengths. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Drop save_counters callback from family_opsPhil Sutter2020-05-181-1/+0
| | | | | | | All families use the same callback function, just fold it into the sole place it's called. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Merge nft_*_rule_find() functionsPhil Sutter2020-05-181-1/+0
| | | | | | | | | Both ebtables and arptables are fine with using nft_ipv46_rule_find() instead of their own implementations. Take the chance and move the former into nft.c as a static helper since it is used in a single place, only. Then get rid of the callback from family_ops. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use clear_cs() instead of open codingPhil Sutter2020-05-111-1/+1
| | | | | | | | In a few places, initialized struct iptables_command_state was not fully deinitialized. Change them to call nft_clear_iptables_command_state() which does it properly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: family_ops: Pass nft_handle to 'rule_to_cs' callbackPhil Sutter2019-11-251-1/+1
| | | | | | | | | | | This is the actual callback used to parse nftables rules. Pass nft_handle to it so it can access the cache (and possible sets therein). Having to pass nft_handle to nft_rule_print_save() allows to simplify it a bit since no family ops lookup has to be done anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'print_rule' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | Prepare for 'rule_to_cs' callback to receive nft_handle pointer so it is able to access cache for set lookups. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'add' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | | In order for add_match() to create anonymous sets when converting xtables matches it needs access to nft handle. So pass it along from callers of family ops' add callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Don't use native nftables commentsPhil Sutter2018-11-271-11/+3
| | | | | | | | | | | | | | | The problem with converting libxt_comment into nftables comment is that rules change when parsing from kernel due to comment match being moved to the end of the match list. And since match ordering matters, the rule may not be found anymore when checking or deleting. Apart from that, iptables-nft didn't support multiple comments per rule anymore. This is a compatibility issue without technical reason. Leave conversion from nftables comment to libxt_comment in place so we don't break running systems during an update. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-nft: fix -f fragment optionFlorian Westphal2018-11-111-1/+1
| | | | | | | | This needs to be passed in network byte order. Reported-by: Arno van Amersfoort <arnova@rocky.eld.leidenuniv.nl> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1292 Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-nft: fix bogus handling of zero saddr/daddrFlorian Westphal2018-11-031-2/+2
| | | | | | | | | | | | | rule for 0.0.0.0/8 is added as 0.0.0.0/0, because we did not check mask (or negation, for that matter). Fix this and add test cases too. This also revealed an ip6tables-nft-save bug, it would print ' !-d', not '! -d'. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1287 Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Don't read garbage in nft_ipv4_parse_payload()Phil Sutter2018-09-241-0/+1
| | | | | | | | | The problem here is that get_frag() does not set 'inv' in any case, so when later checking its value, garbage may be read. Sanitize this case by setting 'inv' to false before calling get_frag(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Share print_ipv{4,6}_addr() from xtablesPhil Sutter2018-09-241-31/+1
| | | | | | | | | | | | | | | | These functions contain code which occurs in legacy's print_firewall() functions, so use them there. Rename them to at least make clear they print more than a single address. Also introduce ipv{4,6}_addr_to_string() which take care of converting an address/netmask pair into string representation in a way which doesn't upset covscan (since that didn't detect that 'buf' may not be exceeded by the strings written into it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Use meta l4proto for -p matchPhil Sutter2018-08-211-2/+1
| | | | | | | | | | | | | | | Use of payload expression to match against IPv6 nexthdr field does not work if extension headers are present. A simple example for that is matching for fragmented icmpv6 traffic. Instead, generate a 'meta l4proto' expression which works even if extension headers are present. For consistency, apply the same change to iptables-nft as well. No adjustment to reverse path required as the needed bits were added by commit 6ea7579e6fe24 ("nft: decode meta l4proto") already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for wrong counter format in -S outputPhil Sutter2018-08-091-8/+2
| | | | | | | | | | | | | | | | | | | | | | Legacy iptables uses '-c PCNT BCNT' format in listed rules, nft-variant used '[PCNT BCNT]' prefix like with iptables-save. In order to pass the counter format preference along, FMT_C_COUNTS is introduced and related 'format' checks adjusted. Since legacy iptables prints the counters between matches and target, this change affects save_matches_and_target() function. In order to get access to the rule counters, it's declaration is adjusted to receive iptables_command_state pointer instead of match, target and jumpto pointers from the same object. While being at it, integrate jump to user-defined chain into it as well since the related code in both callers was almost identical. Though since different rule flags are used between iptables and ip6tables, pass a 'goto_flag' boolean instead of the actual 'flags' bitfield. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Don't pass full invflags to add_compat()Phil Sutter2018-08-091-1/+1
| | | | | | | | | | | The function expects a boolean, not a bitfield. This bug caused inversion in another match to carry over to protocol match by accident. The supplied testcase contains rules which then fail because they contain matches requiring that protocol. Fixes: 4ef77b6d1b52e ("xtables: fix missing protocol and invflags") Fixes: 4143a08819a07 ("ebtables-compat: add nft rule compat information to bridge rules") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: decode meta l4protoFlorian Westphal2018-07-211-0/+10
| | | | | | | Allow to show '-p tcp' in case rule was added by nft (which prefers use of meta l4proto). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce save_chain callbackPhil Sutter2018-07-191-0/+1
| | | | | | | | In preparation for ebtables-save implementation, introduce a callback for convenient per-family formatting of chains in save output. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename {print,save}_rule functionsPhil Sutter2018-07-191-11/+10
| | | | | | | | | The name is quite misleading, since these functions/callbacks are not about the whole ruleset but just a single rule. So rename them to reflect this. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: get rid of nft_ipv{4,6}_save_counters()Phil Sutter2018-07-191-8/+1
| | | | | | | | Just replace them by the shared save_counters() function after adjusting it's signature to meet callback requirements. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: eliminate nft_ipv{4,6}_rule_find()Phil Sutter2018-07-191-9/+1
| | | | | | | | | Both functions just pass their parameters 1:1 to nft_ipv46_rule_find, so replace them by the latter after minor adjustment to match expected callback signature. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: merge nft_ipv{4,6}_parse_target()Phil Sutter2018-07-191-8/+1
| | | | | | | | Both functions are identical, replace them by a common one in nft-shared.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: get rid of nft_ipv{4,6}_print_header()Phil Sutter2018-07-191-9/+1
| | | | | | | | Both functions are identical, just passing all their parameters 1:1 to print_header() shared function. So just replace them by the latter. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce rule_to_cs/clear_cs callbacksPhil Sutter2018-07-191-0/+2
| | | | | | | | This introduces callbacks in nft_family_ops for parsing an nftnl rule into iptables_command_state and clearing it afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fix ipv4 frag (-f)Florian Westphal2018-05-051-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | iptables-translate -A I -f nft add rule ip filter I ip frag-off != 0 counter iptables however checks: frag_off = ntohs(iph->frag_off) & IP_OFFSET; if (NF_INVF(ipinfo, IPT_INV_FRAG, (ipinfo->flags & IPT_F_FRAG) && !frag_off)) return false; So we need to mask off non-offset bits. Second issue is that we negated the meaning in ipt-restore. -f should match if (frag_off & IP_OFFSET) NE 0 ! -f matches non-fragmented packets, i.e. frag_off & IP_OFFSET == 0. So we cannot use nft_invflags2cmp(), as that will use NEQ for negation, but we need EQ instead here. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: output -s,d first during save, just like iptablesFlorian Westphal2018-05-051-5/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fall back to comment match in case name is too longFlorian Westphal2018-05-041-1/+2
| | | | | | | ... or when using multiple --comment lines. This is more of a 'cosmetic' fix to handle the test suite case. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: fix crash when getprotobynumber() returns 0Florian Westphal2018-04-131-6/+8
| | | | | | This needs to first check if pent is NULL. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fix snprintf truncation warningsFlorian Westphal2018-04-081-1/+1
| | | | | | | proto is u16 in the data structure, so this gave: nft-ipv6.c:422:44: warning: '__builtin___snprintf_chk' output may be truncated before the last format character [-Wformat-truncation=] Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fix memory leak when listingPablo M. Bermudo Garay2017-08-141-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following memory leaks are detected by valgrind when ip[6]tables-compat is used for listing operations: ==1604== 1,064 (120 direct, 944 indirect) bytes in 5 blocks are definitely lost in loss record 21 of 27 ==1604== at 0x4C2BBEF: malloc (vg_replace_malloc.c:299) ==1604== by 0x56ABB78: xtables_malloc (in /usr/local/lib/libxtables.so.12.0.0) ==1604== by 0x56AC7D3: xtables_find_match (in /usr/local/lib/libxtables.so.12.0.0) ==1604== by 0x11F502: nft_parse_match (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x11FC7B: nft_rule_to_iptables_command_state (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x1218C0: nft_ipv4_print_firewall (nft-ipv4.c:301) ==1604== by 0x11CBEB: __nft_rule_list (nft.c:2042) ==1604== by 0x11CEA4: nft_rule_list (nft.c:2126) ==1604== by 0x116A7F: list_entries (xtables.c:592) ==1604== by 0x118B26: do_commandx (xtables.c:1233) ==1604== by 0x115AE8: xtables_main (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x115BCB: xtables_ip4_main (in /usr/local/sbin/xtables-compat-multi) ==1604== ==1604== 135,168 bytes in 1 blocks are definitely lost in loss record 25 of 27 ==1604== at 0x4C2BBEF: malloc (vg_replace_malloc.c:299) ==1604== by 0x119072: mnl_nftnl_batch_alloc (nft.c:102) ==1604== by 0x11A311: nft_init (nft.c:777) ==1604== by 0x115A71: xtables_main (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x115BCB: xtables_ip4_main (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x12F911: subcmd_main (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x10F636: main (in /usr/local/sbin/xtables-compat-multi) ==1604== ==1604== 135,168 bytes in 1 blocks are definitely lost in loss record 26 of 27 ==1604== at 0x4C2BBEF: malloc (vg_replace_malloc.c:299) ==1604== by 0x119072: mnl_nftnl_batch_alloc (nft.c:102) ==1604== by 0x11910C: mnl_nftnl_batch_page_add (nft.c:122) ==1604== by 0x11D8FE: nft_action (nft.c:2402) ==1604== by 0x11D957: nft_commit (nft.c:2413) ==1604== by 0x11CCB7: nft_rule_list (nft.c:2076) ==1604== by 0x116A7F: list_entries (xtables.c:592) ==1604== by 0x118B26: do_commandx (xtables.c:1233) ==1604== by 0x115AE8: xtables_main (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x115BCB: xtables_ip4_main (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x12F911: subcmd_main (in /usr/local/sbin/xtables-compat-multi) ==1604== by 0x10F636: main (in /usr/local/sbin/xtables-compat-multi) Fix these memory leaks. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: fix double space before commentPablo M. Bermudo Garay2017-06-061-1/+1
| | | | | | | | | | | | When a comment translation immediately follows a counter statement, two spaces are printed between "counter" and "comment" keywords. The counter statement is almost always followed by a target, so we need to move the space following "counter" to the beginning of the target translation. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: fix the wrong appending of jump verdict after the comment.v1.6.1Shyam Saini2017-01-261-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix wrong appending of jump verdict after the comment For example: $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT Note that even without comment with double-quotes (i.e. --comment "foobar"), it will add quotes: $ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop Attempting to apply the translated/generated rule will result to: $ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT <cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT After this patch $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\" which is correct translation Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Reviewed-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft_ipv{4,6}_xlate: Respect prefix lengthsPhil Sutter2016-11-291-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was an annoying bug in the translator since it silently dropped crucial information which is easily overlooked: | $ iptables-translate -A INPUT -s 192.168.0.0/24 -j ACCEPT | nft add rule ip filter INPUT ip saddr 192.168.0.0 counter accept | $ ip6tables-translate -A INPUT -s feed:babe::/64 -j ACCEPT | nft add rule ip6 filter INPUT ip6 saddr feed:babe:: counter accept To my surprise, this fix works really well in all kinds of situations: | $ iptables-translate -A INPUT -s 1.2.3.4/0 -j ACCEPT | nft add rule ip filter INPUT counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/23 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.2.0/23 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/24 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.3.0/24 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/32 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.3.4 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/255.255.0.0 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.0.0/16 counter accept Ditto for IPv6. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: add escape_quotes option to comment_xlatePablo M. Bermudo Garay2016-08-231-1/+1
| | | | | | | | The comment_xlate function was not supporting this option that is necessary in some situations. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>