Re: [PATCH] iptables: fix the wrong appending of jump verdict after the comment.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jan 26, 2017 at 2:49 PM, Shyam Saini <mayhs11saini@xxxxxxxxx> wrote:
> Fix wrong appending of jump verdict after the comment
>
> For example:
> $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s  192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar"
> nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT
>
> Note that even without comment with double-quotes (i.e. --comment
> "foobar"), it will add quotes:
>
> $ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment
> nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop
>
> Attempting to apply the translated/generated rule will result to:
>
> $ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr  192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT
> <cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon
> add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT
>
> After this patch
> $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar"
> nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\"
> which is correct translation
>
> Signed-off-by: Shyam Saini <mayhs11saini@xxxxxxxxx>

Reviewed-by: Shivani Bhardwaj <shivanib134@xxxxxxxxx>

It does get accepted by nft. Sorry about the last mail.
You could probably send out similar patch for ip6 too.

Shivani

> ---
>  iptables/nft-ipv4.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
> index 52b1bed..e5947a7 100644
> --- a/iptables/nft-ipv4.c
> +++ b/iptables/nft-ipv4.c
> @@ -489,12 +489,11 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
>
>         /* Always add counters per rule, as in iptables */
>         xt_xlate_add(xl, "counter ");
> +       ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
>
>         comment = xt_xlate_get_comment(xl);
>         if (comment)
> -               xt_xlate_add(xl, "comment %s", comment);
> -
> -       ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
> +               xt_xlate_add(xl, " comment %s", comment);
>
>         return ret;
>  }
> --
> 2.7.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux