For nft, asterisk is special at end of the interface name only. Escaping
it mid-string makes the escape char part of the interface name, so avoid
this.
In the test case, also drop the ticks around interface names in
*-translate command - since there's no shell involved which would eat
them, they become part of the interface name.
Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases")
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
extensions/generic.txlate | 14 +++++++-------
iptables/xtables-translate.c | 4 +++-
2 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/extensions/generic.txlate b/extensions/generic.txlate
index 7e879fd526bb1..d7ddf6a39762e 100644
--- a/extensions/generic.txlate
+++ b/extensions/generic.txlate
@@ -74,17 +74,17 @@ ebtables-translate -I INPUT -p ! Length
nft 'insert rule bridge filter INPUT ether type >= 0x0600 counter'
# asterisk is not special in iptables and it is even a valid interface name
-iptables-translate -A FORWARD -i '*' -o 'eth*foo'
-nft 'add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter'
+iptables-translate -A FORWARD -i * -o eth*foo
+nft 'add rule ip filter FORWARD iifname "\*" oifname "eth*foo" counter'
-# escape all asterisks but translate only the first plus character
-iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++'
-nft 'add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter'
+# escape only suffix asterisk and translate only the last plus character
+iptables-translate -A FORWARD -i eth*foo*+ -o eth++
+nft 'add rule ip filter FORWARD iifname "eth*foo**" oifname "eth+*" counter'
# skip for always matching interface names
-iptables-translate -A FORWARD -i '+'
+iptables-translate -A FORWARD -i +
nft 'add rule ip filter FORWARD counter'
# match against invalid interface name to simulate never matching rule
-iptables-translate -A FORWARD ! -i '+'
+iptables-translate -A FORWARD ! -i +
nft 'add rule ip filter FORWARD iifname "INVAL/D" counter'
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 6b71fcef74b9c..07d6ee40cf727 100644
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -41,7 +41,9 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
switch (ifname[i]) {
case '*':
- iface[j++] = '\\';
+ /* asterisk is non-special mid-string */
+ if (i == ifaclen - 1)
+ iface[j++] = '\\';
/* fall through */
default:
iface[j] = ifname[i];
--
2.38.0
