From 0ddd663e9c167f9f0451dac8c02bbfcda25fe15e Mon Sep 17 00:00:00 2001 From: Liping Zhang Date: Sat, 30 Jul 2016 13:20:59 +0800 Subject: iptables-translate: add in/out ifname wildcard match translation to nft In iptables, "-i eth+" means match all in ifname with the prefix "eth". But in nftables, this was changed to "iifname eth*". So we should handle this subtle difference. Apply this patch, translation will become: # iptables-translate -A INPUT -i eth+ nft add rule ip filter INPUT iifname eth* counter # ip6tables-translate -A OUTPUT ! -o eth+ nft add rule ip6 filter OUTPUT oifname != eth* counter Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso --- iptables/nft.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'iptables/nft.h') diff --git a/iptables/nft.h b/iptables/nft.h index 9e02eeb1..88674340 100644 --- a/iptables/nft.h +++ b/iptables/nft.h @@ -165,6 +165,8 @@ bool xlate_find_match(const struct iptables_command_state *cs, const char *p_nam int xlate_matches(const struct iptables_command_state *cs, struct xt_xlate *xl); int xlate_action(const struct iptables_command_state *cs, bool goto_set, struct xt_xlate *xl); +void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + bool invert); /* * ARP -- cgit v1.2.3