[PATCH] remove unneeded ip6tables-save source/destination address output

[PATCH] remove unneeded ip6tables-save source/destination address output

[Daniel De Graaf]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ip6tables-save outputs the source and destination IPs when it is not
needed. This
is caused by an incorrectly copied check from iptables-save. Example
output:
- -A INPUT -s ::/0 -d ::/0 -i lo -j ACCEPT instead of just -A INPUT -i
lo -j ACCEPT

This patch will not output the address if the mask length is zero.

- - Daniel De Graaf

Index: ip6tables-save.c
===================================================================
- --- ip6tables-save.c    (revision 6699)
+++ ip6tables-save.c    (working copy)
@@ -125,7 +125,7 @@
        char buf[51];
        int l = ipv6_prefix_length(mask);
 
- -       if (!mask && !ip)
+       if (l == 0)
                return;
 
        printf("%s %s%s",
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFcM3DZz9quLVV3/MRAuYSAJ9wUCXr8yEiClPeuVfANBISlzBGTACffYHh
dFqNciiAzKuvSTw7pXV2cAA=
=Ssso
-----END PGP SIGNATURE-----

Re: [PATCH] remove unneeded ip6tables-save source/destination address output

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 793 bytes --]

Daniel De Graaf wrote:
> ip6tables-save outputs the source and destination IPs when it is not
> needed. This
> is caused by an incorrectly copied check from iptables-save. Example
> output:
> -A INPUT -s ::/0 -d ::/0 -i lo -j ACCEPT instead of just -A INPUT -i
> lo -j ACCEPT
> 
> This patch will not output the address if the mask length is zero.
> 
> - Daniel De Graaf
> 
> Index: ip6tables-save.c
> ===================================================================
> --- ip6tables-save.c    (revision 6699)
> +++ ip6tables-save.c    (working copy)
> @@ -125,7 +125,7 @@
>         char buf[51];
>         int l = ipv6_prefix_length(mask);
>  
> -       if (!mask && !ip)
> +       if (l == 0)

They both seem wrong since they ignore inversion (-s !0/0). I've
committed this patch instead.

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 726 bytes --]

Index: iptables-save.c
===================================================================
--- iptables-save.c	(Revision 6698)
+++ iptables-save.c	(Arbeitskopie)
@@ -141,7 +141,7 @@
 /* print a given ip including mask if neccessary */
 static void print_ip(char *prefix, u_int32_t ip, u_int32_t mask, int invert)
 {
-	if (!mask && !ip)
+	if (!mask && !ip && !invert)
 		return;
 
 	printf("%s %s%u.%u.%u.%u",
Index: ip6tables-save.c
===================================================================
--- ip6tables-save.c	(Revision 6698)
+++ ip6tables-save.c	(Arbeitskopie)
@@ -125,7 +125,7 @@
 	char buf[51];
 	int l = ipv6_prefix_length(mask);
 
-	if (!mask && !ip)
+	if (l == 0 && !invert)
 		return;
 
 	printf("%s %s%s",