On Thu, Jan 26, 2017 at 05:06:56PM +0530, Shivani Bhardwaj wrote: > On Thu, Jan 26, 2017 at 2:49 PM, Shyam Saini <mayhs11saini@xxxxxxxxx> wrote: > > Fix wrong appending of jump verdict after the comment > > > > For example: > > $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" > > nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT > > > > Note that even without comment with double-quotes (i.e. --comment > > "foobar"), it will add quotes: > > > > $ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment > > nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop > > > > Attempting to apply the translated/generated rule will result to: > > > > $ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT > > <cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon > > add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT > > > > After this patch > > $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" > > nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\" > > which is correct translation > > > > Signed-off-by: Shyam Saini <mayhs11saini@xxxxxxxxx> > > Reviewed-by: Shivani Bhardwaj <shivanib134@xxxxxxxxx> > > It does get accepted by nft. Sorry about the last mail. > You could probably send out similar patch for ip6 too. I have mangled your patch to include the missing IPv6 chunk. So this patch has been applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
