From 0ddd663e9c167f9f0451dac8c02bbfcda25fe15e Mon Sep 17 00:00:00 2001 From: Liping Zhang Date: Sat, 30 Jul 2016 13:20:59 +0800 Subject: iptables-translate: add in/out ifname wildcard match translation to nft In iptables, "-i eth+" means match all in ifname with the prefix "eth". But in nftables, this was changed to "iifname eth*". So we should handle this subtle difference. Apply this patch, translation will become: # iptables-translate -A INPUT -i eth+ nft add rule ip filter INPUT iifname eth* counter # ip6tables-translate -A OUTPUT ! -o eth+ nft add rule ip6 filter OUTPUT oifname != eth* counter Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso --- iptables/nft-ipv6.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) (limited to 'iptables/nft-ipv6.c') diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index bfbf8dff..8ca523c8 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -404,18 +404,10 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) const char *comment; int ret; - if (cs->fw6.ipv6.iniface[0] != '\0') { - xt_xlate_add(xl, "iifname %s%s ", - cs->fw6.ipv6.invflags & IP6T_INV_VIA_IN ? - "!= " : "", - cs->fw6.ipv6.iniface); - } - if (cs->fw6.ipv6.outiface[0] != '\0') { - xt_xlate_add(xl, "oifname %s%s ", - cs->fw6.ipv6.invflags & IP6T_INV_VIA_OUT ? - "!= " : "", - cs->fw6.ipv6.outiface); - } + xlate_ifname(xl, "iifname", cs->fw6.ipv6.iniface, + cs->fw6.ipv6.invflags & IP6T_INV_VIA_IN); + xlate_ifname(xl, "oifname", cs->fw6.ipv6.outiface, + cs->fw6.ipv6.invflags & IP6T_INV_VIA_OUT); if (cs->fw6.ipv6.proto != 0) { const struct protoent *pent = -- cgit v1.2.3