From f1cd86ddcf1726b91aedb9ef916b380edc8c2b61 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 25 Nov 2016 18:52:55 +0100 Subject: nft_ipv{4,6}_xlate: Respect prefix lengths This was an annoying bug in the translator since it silently dropped crucial information which is easily overlooked: | $ iptables-translate -A INPUT -s 192.168.0.0/24 -j ACCEPT | nft add rule ip filter INPUT ip saddr 192.168.0.0 counter accept | $ ip6tables-translate -A INPUT -s feed:babe::/64 -j ACCEPT | nft add rule ip6 filter INPUT ip6 saddr feed:babe:: counter accept To my surprise, this fix works really well in all kinds of situations: | $ iptables-translate -A INPUT -s 1.2.3.4/0 -j ACCEPT | nft add rule ip filter INPUT counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/23 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.2.0/23 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/24 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.3.0/24 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/32 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.3.4 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/255.255.0.0 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.0.0/16 counter accept Ditto for IPv6. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- iptables/nft-ipv4.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'iptables/nft-ipv4.c') diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 295dd425..52b1bed2 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -471,14 +471,16 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) } if (cs->fw.ip.src.s_addr != 0) { - xt_xlate_add(xl, "ip saddr %s%s ", + xt_xlate_add(xl, "ip saddr %s%s%s ", cs->fw.ip.invflags & IPT_INV_SRCIP ? "!= " : "", - inet_ntoa(cs->fw.ip.src)); + inet_ntoa(cs->fw.ip.src), + xtables_ipmask_to_numeric(&cs->fw.ip.smsk)); } if (cs->fw.ip.dst.s_addr != 0) { - xt_xlate_add(xl, "ip daddr %s%s ", + xt_xlate_add(xl, "ip daddr %s%s%s ", cs->fw.ip.invflags & IPT_INV_DSTIP ? "!= " : "", - inet_ntoa(cs->fw.ip.dst)); + inet_ntoa(cs->fw.ip.dst), + xtables_ipmask_to_numeric(&cs->fw.ip.dmsk)); } ret = xlate_matches(cs, xl); -- cgit v1.2.3