From 75cb763b54a89bf9b9c61740c760abce89df06f3 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sun, 15 Nov 2009 15:51:27 +0100 Subject: iptables: take masks into consideration for replace command The two commands: -A OUPUT -d 10.11.12.13/32 -j LOG -R OUTPUT 1 -j LOG -d 10.11.12.13 will replace 10.11.12.13/32 by 10.11.12.13/0, which is not right. (No regression, this problem was there forever.) Reported-by: Werner Pawlitschko Signed-off-by: Jan Engelhardt --- iptables.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'iptables.c') diff --git a/iptables.c b/iptables.c index a69aab30..08eb1345 100644 --- a/iptables.c +++ b/iptables.c @@ -760,13 +760,15 @@ static int replace_entry(const ipt_chainlabel chain, struct ipt_entry *fw, unsigned int rulenum, - const struct in_addr *saddr, - const struct in_addr *daddr, + const struct in_addr *saddr, const struct in_addr *smask, + const struct in_addr *daddr, const struct in_addr *dmask, int verbose, struct iptc_handle *handle) { fw->ip.src.s_addr = saddr->s_addr; fw->ip.dst.s_addr = daddr->s_addr; + fw->ip.smsk.s_addr = smask->s_addr; + fw->ip.dmsk.s_addr = dmask->s_addr; if (verbose) print_firewall_line(fw, handle); @@ -1988,8 +1990,8 @@ int do_command(int argc, char *argv[], char **table, struct iptc_handle **handle break; case CMD_REPLACE: ret = replace_entry(chain, e, rulenum - 1, - saddrs, daddrs, options&OPT_VERBOSE, - *handle); + saddrs, smasks, daddrs, dmasks, + options&OPT_VERBOSE, *handle); break; case CMD_INSERT: ret = insert_entry(chain, e, rulenum - 1, -- cgit v1.2.3