Initializing comment member in xt_xlate structure. Because of not initializing, when translating iptables command with multiple ip addresses, In the translated commands --comment field is getting added. Before fix: inbhdhcp21574:basavaia$>sudo ./iptables-translate -A INPUT --source "40.0.0.1, 30.0.0.1" --dest "20.0.0.1, 60.0.0.1" -j ACCEPT nft add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 20.0.0.1 counter accept add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 20.0.0.1 counter comment \" \" accept add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept After fix: inbhdhcp21574:basavaia$>sudo ./iptables-translate -A INPUT --source "40.0.0.1, 30.0.0.1" --dest "20.0.0.1, 60.0.0.1" -j ACCEPT nft add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 20.0.0.1 counter accept add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 60.0.0.1 counter accept add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 20.0.0.1 counter accept add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 60.0.0.1 counter accept Signed-off-by: Guruswamy Basavaiah <guru2018@xxxxxxxxx> --- libxtables/xtables.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libxtables/xtables.c b/libxtables/xtables.c index fe24caa..cdb56c0 100644 --- a/libxtables/xtables.c +++ b/libxtables/xtables.c @@ -2014,6 +2014,7 @@ struct xt_xlate *xt_xlate_alloc(int size) xl->buf.size = size; xl->buf.rem = size; xl->buf.off = 0; + bzero(xl->comment, NFT_USERDATA_MAXLEN); return xl; } -- 2.5.0 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
