From f035be35c749d5c5cbb7ffdbcd1c548b91bd3033 Mon Sep 17 00:00:00 2001 From: "Pablo M. Bermudo Garay" Date: Sat, 9 Jul 2016 12:27:51 +0200 Subject: xtables-translate: fix multiple spaces issue This patch fixes a multiple spaces issue. The problem arises when a rule set loaded through iptables-compat-restore is listed in nft. Before this commit, two spaces were printed after every match translation: $ sudo iptables-save *filter :INPUT ACCEPT [0:0] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m multiport --dports 80:85 -m ttl --ttl-gt 5 -j ACCEPT COMMIT $ sudo iptables-compat-restore iptables-save $ sudo nft list ruleset table ip filter { chain INPUT { type filter hook input priority 0; policy accept; ct state related,established counter packets 0 bytes 0 accept ^^ ip protocol tcp tcp dport 80-85 ip ttl gt 5 counter packets 0 bytes 0 accept ^^ ^^ } } Signed-off-by: Pablo M. Bermudo Garay Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_multiport.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) (limited to 'extensions/libxt_multiport.c') diff --git a/extensions/libxt_multiport.c b/extensions/libxt_multiport.c index e420a0f1..94b3f54d 100644 --- a/extensions/libxt_multiport.c +++ b/extensions/libxt_multiport.c @@ -477,10 +477,10 @@ static int __multiport_xlate(const void *ip, const struct xt_entry_match *match, switch (multiinfo->flags) { case XT_MULTIPORT_SOURCE: - xt_xlate_add(xl, "sport "); + xt_xlate_add(xl, " sport "); break; case XT_MULTIPORT_DESTINATION: - xt_xlate_add(xl, "dport "); + xt_xlate_add(xl, " dport "); break; case XT_MULTIPORT_EITHER: return 0; @@ -495,8 +495,6 @@ static int __multiport_xlate(const void *ip, const struct xt_entry_match *match, if (multiinfo->count > 1) xt_xlate_add(xl, "}"); - xt_xlate_add(xl, " "); - return 1; } @@ -505,7 +503,7 @@ static int multiport_xlate(const void *ip, const struct xt_entry_match *match, { uint8_t proto = ((const struct ipt_ip *)ip)->proto; - xt_xlate_add(xl, "%s ", proto_to_name(proto)); + xt_xlate_add(xl, "%s", proto_to_name(proto)); return __multiport_xlate(ip, match, xl, numeric); } @@ -514,7 +512,7 @@ static int multiport_xlate6(const void *ip, const struct xt_entry_match *match, { uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto; - xt_xlate_add(xl, "%s ", proto_to_name(proto)); + xt_xlate_add(xl, "%s", proto_to_name(proto)); return __multiport_xlate(ip, match, xl, numeric); } @@ -528,10 +526,10 @@ static int __multiport_xlate_v1(const void *ip, switch (multiinfo->flags) { case XT_MULTIPORT_SOURCE: - xt_xlate_add(xl, "sport "); + xt_xlate_add(xl, " sport "); break; case XT_MULTIPORT_DESTINATION: - xt_xlate_add(xl, "dport "); + xt_xlate_add(xl, " dport "); break; case XT_MULTIPORT_EITHER: return 0; @@ -554,8 +552,6 @@ static int __multiport_xlate_v1(const void *ip, (multiinfo->count > 1 && !multiinfo->pflags[0])) xt_xlate_add(xl, "}"); - xt_xlate_add(xl, " "); - return 1; } @@ -565,7 +561,7 @@ static int multiport_xlate_v1(const void *ip, { uint8_t proto = ((const struct ipt_ip *)ip)->proto; - xt_xlate_add(xl, "%s ", proto_to_name(proto)); + xt_xlate_add(xl, "%s", proto_to_name(proto)); return __multiport_xlate_v1(ip, match, xl, numeric); } @@ -575,7 +571,7 @@ static int multiport_xlate6_v1(const void *ip, { uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto; - xt_xlate_add(xl, "%s ", proto_to_name(proto)); + xt_xlate_add(xl, "%s", proto_to_name(proto)); return __multiport_xlate_v1(ip, match, xl, numeric); } -- cgit v1.2.3