* [PATCH v2] nft-shared: adds save_matches_and_target
@ 2014-02-10 15:49 Giuseppe Longo
2014-02-10 15:49 ` [PATCH v2] xtables-events: prints arp rules Giuseppe Longo
2014-02-11 12:49 ` [PATCH v2] nft-shared: adds save_matches_and_target Pablo Neira Ayuso
0 siblings, 2 replies; 4+ messages in thread
From: Giuseppe Longo @ 2014-02-10 15:49 UTC (permalink / raw)
To: netfilter-devel; +Cc: Giuseppe Longo
This patch permits to save matches and target for ip/ip6/eb family,
required for xtables-events.
Also, generalizes nft_rule_print_save to be reused for all protocol families.
Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
iptables/nft-ipv4.c | 7 +++++--
iptables/nft-ipv6.c | 7 +++++--
iptables/nft-shared.c | 35 +++++++++++++++++++++++++++++++++++
iptables/nft-shared.h | 6 +++++-
iptables/nft.c | 33 +++------------------------------
iptables/nft.h | 2 +-
6 files changed, 54 insertions(+), 36 deletions(-)
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 1afe8b6..e18a649 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -309,9 +309,11 @@ static void save_ipv4_addr(char letter, const struct in_addr *addr,
mask_to_str(mask));
}
-static uint8_t nft_ipv4_save_firewall(const struct iptables_command_state *cs,
+static void nft_ipv4_save_firewall(const void *data,
unsigned int format)
{
+ const struct iptables_command_state *cs = data;
+
save_firewall_details(cs, cs->fw.ip.invflags, cs->fw.ip.proto,
cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
cs->fw.ip.outiface, cs->fw.ip.outiface_mask,
@@ -328,7 +330,8 @@ static uint8_t nft_ipv4_save_firewall(const struct iptables_command_state *cs,
save_ipv4_addr('d', &cs->fw.ip.dst, cs->fw.ip.dmsk.s_addr,
cs->fw.ip.invflags & IPT_INV_DSTIP);
- return cs->fw.ip.flags;
+ save_matches_and_target(cs->matches, cs->target, cs->jumpto,
+ cs->fw.ip.flags, &cs);
}
static void nft_ipv4_proto_parse(struct iptables_command_state *cs,
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index f30cec6..4beb411 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -218,9 +218,11 @@ static void save_ipv6_addr(char letter, const struct in6_addr *addr,
printf("%s-%c %s ", invert ? "! " : "", letter, addr_str);
}
-static uint8_t nft_ipv6_save_firewall(const struct iptables_command_state *cs,
+static void nft_ipv6_save_firewall(const void *data,
unsigned int format)
{
+ const struct iptables_command_state *cs = data;
+
save_firewall_details(cs, cs->fw6.ipv6.invflags, cs->fw6.ipv6.proto,
cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask,
cs->fw6.ipv6.outiface, cs->fw6.ipv6.outiface_mask,
@@ -231,7 +233,8 @@ static uint8_t nft_ipv6_save_firewall(const struct iptables_command_state *cs,
save_ipv6_addr('d', &cs->fw6.ipv6.dst,
cs->fw6.ipv6.invflags & IPT_INV_DSTIP);
- return cs->fw6.ipv6.flags;
+ save_matches_and_target(cs->matches, cs->target, cs->jumpto,
+ cs->fw6.ipv6.flags, &cs);
}
/* These are invalid numbers as upper layer protocol */
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 233011c..29bfab7 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -621,6 +621,41 @@ void save_firewall_details(const struct iptables_command_state *cs,
}
}
+void save_matches_and_target(struct xtables_rule_match *m,
+ struct xtables_target *target,
+ const char *jumpto,
+ uint8_t flags, void *fw)
+{
+ struct xtables_rule_match *matchp;
+
+ for (matchp = m; matchp; matchp = matchp->next) {
+ if (matchp->match->alias) {
+ printf("-m %s",
+ matchp->match->alias(matchp->match->m));
+ } else
+ printf("-m %s", matchp->match->name);
+
+ if (matchp->match->save != NULL) {
+ /* cs->fw union makes the trick */
+ matchp->match->save(&fw, matchp->match->m);
+ }
+ printf(" ");
+ }
+
+ if (target != NULL) {
+ if (target->alias) {
+ printf("-j %s", target->alias(target->t));
+ } else
+ printf("-j %s", jumpto);
+
+ if (target->save != NULL)
+ target->save(fw, target->t);
+ } else if (strlen(jumpto) > 0)
+ printf("-%c %s", flags & IPT_F_GOTO ? 'g' : 'j', jumpto);
+
+ printf("\n");
+}
+
void print_matches_and_target(struct iptables_command_state *cs,
unsigned int format)
{
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
index 9df17bc..676cdca 100644
--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
@@ -49,7 +49,7 @@ struct nft_family_ops {
void (*parse_immediate)(const char *jumpto, bool nft_goto, void *data);
void (*print_firewall)(struct nft_rule *r, unsigned int num,
unsigned int format);
- uint8_t (*save_firewall)(const struct iptables_command_state *cs,
+ void (*save_firewall)(const void *data,
unsigned int format);
void (*proto_parse)(struct iptables_command_state *cs,
struct xtables_args *args);
@@ -118,6 +118,10 @@ void save_firewall_details(const struct iptables_command_state *cs,
const char *outiface,
unsigned const char *outiface_mask,
unsigned int format);
+void save_matches_and_target(struct xtables_rule_match *m,
+ struct xtables_target *target,
+ const char *jumpto,
+ uint8_t flags, void *fw);
struct nft_family_ops *nft_family_ops_lookup(int family);
diff --git a/iptables/nft.c b/iptables/nft.c
index 8c8c026..a3a294a 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1038,15 +1038,13 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
}
void
-nft_rule_print_save(const struct iptables_command_state *cs,
+nft_rule_print_save(const void *data,
struct nft_rule *r, enum nft_rule_print type,
unsigned int format)
{
const char *chain = nft_rule_attr_get_str(r, NFT_RULE_ATTR_CHAIN);
int family = nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY);
- struct xtables_rule_match *matchp;
struct nft_family_ops *ops;
- int ip_flags = 0;
/* print chain name */
switch(type) {
@@ -1059,35 +1057,10 @@ nft_rule_print_save(const struct iptables_command_state *cs,
}
ops = nft_family_ops_lookup(family);
- ip_flags = ops->save_firewall(cs, format);
-
- for (matchp = cs->matches; matchp; matchp = matchp->next) {
- if (matchp->match->alias) {
- printf("-m %s",
- matchp->match->alias(matchp->match->m));
- } else
- printf("-m %s", matchp->match->name);
-
- if (matchp->match->save != NULL) {
- /* cs->fw union makes the trick */
- matchp->match->save(&cs->fw, matchp->match->m);
- }
- printf(" ");
- }
- if (cs->target != NULL) {
- if (cs->target->alias) {
- printf("-j %s", cs->target->alias(cs->target->t));
- } else
- printf("-j %s", cs->jumpto);
+ if (ops->save_firewall)
+ ops->save_firewall(data, format);
- if (cs->target->save != NULL)
- cs->target->save(&cs->fw, cs->target->t);
- } else if (strlen(cs->jumpto) > 0)
- printf("-%c %s", ip_flags & IPT_F_GOTO ? 'g' : 'j',
- cs->jumpto);
-
- printf("\n");
}
static int nft_chain_list_cb(const struct nlmsghdr *nlh, void *data)
diff --git a/iptables/nft.h b/iptables/nft.h
index 68f674e..fc380d9 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -115,7 +115,7 @@ enum nft_rule_print {
NFT_RULE_DEL,
};
-void nft_rule_print_save(const struct iptables_command_state *cs,
+void nft_rule_print_save(const void *data,
struct nft_rule *r, enum nft_rule_print type,
unsigned int format);
--
1.8.1.5
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v2] xtables-events: prints arp rules
2014-02-10 15:49 [PATCH v2] nft-shared: adds save_matches_and_target Giuseppe Longo
@ 2014-02-10 15:49 ` Giuseppe Longo
2014-02-11 12:05 ` Pablo Neira Ayuso
2014-02-11 12:49 ` [PATCH v2] nft-shared: adds save_matches_and_target Pablo Neira Ayuso
1 sibling, 1 reply; 4+ messages in thread
From: Giuseppe Longo @ 2014-02-10 15:49 UTC (permalink / raw)
To: netfilter-devel; +Cc: Giuseppe Longo
This patch permits to print arp rules,
avoiding the segfault that you got currently.
Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
iptables/xtables-events.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/iptables/xtables-events.c b/iptables/xtables-events.c
index 408e091..75459c1 100644
--- a/iptables/xtables-events.c
+++ b/iptables/xtables-events.c
@@ -59,7 +59,10 @@ static bool counters;
static int rule_cb(const struct nlmsghdr *nlh, int type)
{
struct iptables_command_state cs = {};
+ struct arpt_entry fw_arp = {};
struct nft_rule *r;
+ void *fw = NULL;
+ uint8_t family;
r = nft_rule_alloc();
if (r == NULL) {
@@ -72,21 +75,23 @@ static int rule_cb(const struct nlmsghdr *nlh, int type)
goto err_free;
}
- nft_rule_to_iptables_command_state(r, &cs);
-
- switch(nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY)) {
+ family = nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY);
+ switch(family) {
case AF_INET:
- printf("-4 ");
- break;
case AF_INET6:
- printf("-6 ");
+ printf("-%c ", family == AF_INET ? '4' : '6');
+ nft_rule_to_iptables_command_state(r, &cs);
+ fw = &cs;
break;
+ case NFPROTO_ARP:
+ nft_rule_to_arpt_entry(r, &fw_arp);
+ fw = &fw_arp;
default:
break;
}
- nft_rule_print_save(&cs, r,
+ nft_rule_print_save(fw, r,
type == NFT_MSG_NEWRULE ? NFT_RULE_APPEND :
NFT_RULE_DEL,
counters ? 0 : FMT_NOCOUNTS);
--
1.8.1.5
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] xtables-events: prints arp rules
2014-02-10 15:49 ` [PATCH v2] xtables-events: prints arp rules Giuseppe Longo
@ 2014-02-11 12:05 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2014-02-11 12:05 UTC (permalink / raw)
To: Giuseppe Longo; +Cc: netfilter-devel
On Mon, Feb 10, 2014 at 04:49:34PM +0100, Giuseppe Longo wrote:
> This patch permits to print arp rules,
> avoiding the segfault that you got currently.
There is no .save_firewall hook for nft-arp, so this does not print
anything. Did you forget to include it in your patch?
More comments below.
> Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
> ---
> iptables/xtables-events.c | 19 ++++++++++++-------
> 1 file changed, 12 insertions(+), 7 deletions(-)
>
> diff --git a/iptables/xtables-events.c b/iptables/xtables-events.c
> index 408e091..75459c1 100644
> --- a/iptables/xtables-events.c
> +++ b/iptables/xtables-events.c
> @@ -59,7 +59,10 @@ static bool counters;
> static int rule_cb(const struct nlmsghdr *nlh, int type)
> {
> struct iptables_command_state cs = {};
> + struct arpt_entry fw_arp = {};
> struct nft_rule *r;
> + void *fw = NULL;
> + uint8_t family;
>
> r = nft_rule_alloc();
> if (r == NULL) {
> @@ -72,21 +75,23 @@ static int rule_cb(const struct nlmsghdr *nlh, int type)
> goto err_free;
> }
>
> - nft_rule_to_iptables_command_state(r, &cs);
> -
> - switch(nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY)) {
> + family = nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY);
> + switch(family) {
> case AF_INET:
> - printf("-4 ");
> - break;
> case AF_INET6:
> - printf("-6 ");
> + printf("-%c ", family == AF_INET ? '4' : '6');
> + nft_rule_to_iptables_command_state(r, &cs);
> + fw = &cs;
> break;
> + case NFPROTO_ARP:
> + nft_rule_to_arpt_entry(r, &fw_arp);
> + fw = &fw_arp;
missing break; here.
> default:
> break;
Instead of this break;, please use:
goto err_free;
so it just skips nft_rule_print_save for unknown families.
> }
>
>
> - nft_rule_print_save(&cs, r,
> + nft_rule_print_save(fw, r,
> type == NFT_MSG_NEWRULE ? NFT_RULE_APPEND :
> NFT_RULE_DEL,
> counters ? 0 : FMT_NOCOUNTS);
> --
> 1.8.1.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] nft-shared: adds save_matches_and_target
2014-02-10 15:49 [PATCH v2] nft-shared: adds save_matches_and_target Giuseppe Longo
2014-02-10 15:49 ` [PATCH v2] xtables-events: prints arp rules Giuseppe Longo
@ 2014-02-11 12:49 ` Pablo Neira Ayuso
1 sibling, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2014-02-11 12:49 UTC (permalink / raw)
To: Giuseppe Longo; +Cc: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 5400 bytes --]
On Mon, Feb 10, 2014 at 04:49:33PM +0100, Giuseppe Longo wrote:
> This patch permits to save matches and target for ip/ip6/eb family,
> required for xtables-events.
>
> Also, generalizes nft_rule_print_save to be reused for all protocol families.
>
> Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
> ---
> iptables/nft-ipv4.c | 7 +++++--
> iptables/nft-ipv6.c | 7 +++++--
> iptables/nft-shared.c | 35 +++++++++++++++++++++++++++++++++++
> iptables/nft-shared.h | 6 +++++-
> iptables/nft.c | 33 +++------------------------------
> iptables/nft.h | 2 +-
> 6 files changed, 54 insertions(+), 36 deletions(-)
>
> diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
> index 1afe8b6..e18a649 100644
> --- a/iptables/nft-ipv4.c
> +++ b/iptables/nft-ipv4.c
> @@ -309,9 +309,11 @@ static void save_ipv4_addr(char letter, const struct in_addr *addr,
> mask_to_str(mask));
> }
>
> -static uint8_t nft_ipv4_save_firewall(const struct iptables_command_state *cs,
> +static void nft_ipv4_save_firewall(const void *data,
> unsigned int format)
This fits in 80-chars line, no need to break it. I have fixed this
here.
> {
> + const struct iptables_command_state *cs = data;
> +
> save_firewall_details(cs, cs->fw.ip.invflags, cs->fw.ip.proto,
> cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
> cs->fw.ip.outiface, cs->fw.ip.outiface_mask,
> @@ -328,7 +330,8 @@ static uint8_t nft_ipv4_save_firewall(const struct iptables_command_state *cs,
> save_ipv4_addr('d', &cs->fw.ip.dst, cs->fw.ip.dmsk.s_addr,
> cs->fw.ip.invflags & IPT_INV_DSTIP);
>
> - return cs->fw.ip.flags;
> + save_matches_and_target(cs->matches, cs->target, cs->jumpto,
> + cs->fw.ip.flags, &cs);
You're passing &cs here... (continues below)
> }
>
> static void nft_ipv4_proto_parse(struct iptables_command_state *cs,
> diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
> index f30cec6..4beb411 100644
> --- a/iptables/nft-ipv6.c
> +++ b/iptables/nft-ipv6.c
> @@ -218,9 +218,11 @@ static void save_ipv6_addr(char letter, const struct in6_addr *addr,
> printf("%s-%c %s ", invert ? "! " : "", letter, addr_str);
> }
>
> -static uint8_t nft_ipv6_save_firewall(const struct iptables_command_state *cs,
> +static void nft_ipv6_save_firewall(const void *data,
> unsigned int format)
> {
> + const struct iptables_command_state *cs = data;
> +
> save_firewall_details(cs, cs->fw6.ipv6.invflags, cs->fw6.ipv6.proto,
> cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask,
> cs->fw6.ipv6.outiface, cs->fw6.ipv6.outiface_mask,
> @@ -231,7 +233,8 @@ static uint8_t nft_ipv6_save_firewall(const struct iptables_command_state *cs,
> save_ipv6_addr('d', &cs->fw6.ipv6.dst,
> cs->fw6.ipv6.invflags & IPT_INV_DSTIP);
>
> - return cs->fw6.ipv6.flags;
> + save_matches_and_target(cs->matches, cs->target, cs->jumpto,
> + cs->fw6.ipv6.flags, &cs);
> }
>
> /* These are invalid numbers as upper layer protocol */
> diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
> index 233011c..29bfab7 100644
> --- a/iptables/nft-shared.c
> +++ b/iptables/nft-shared.c
> @@ -621,6 +621,41 @@ void save_firewall_details(const struct iptables_command_state *cs,
> }
> }
>
> +void save_matches_and_target(struct xtables_rule_match *m,
> + struct xtables_target *target,
> + const char *jumpto,
> + uint8_t flags, void *fw)
But save_matches_and_target takes a void *fw. Beware with pointer
handling, I guess you did that to resolve a compilation warning but
that was not the way to make.
I have fixed this as well.
> +{
> + struct xtables_rule_match *matchp;
> +
> + for (matchp = m; matchp; matchp = matchp->next) {
> + if (matchp->match->alias) {
> + printf("-m %s",
> + matchp->match->alias(matchp->match->m));
> + } else
> + printf("-m %s", matchp->match->name);
> +
> + if (matchp->match->save != NULL) {
> + /* cs->fw union makes the trick */
> + matchp->match->save(&fw, matchp->match->m);
> + }
> + printf(" ");
> + }
> +
> + if (target != NULL) {
> + if (target->alias) {
> + printf("-j %s", target->alias(target->t));
> + } else
> + printf("-j %s", jumpto);
> +
> + if (target->save != NULL)
> + target->save(fw, target->t);
> + } else if (strlen(jumpto) > 0)
> + printf("-%c %s", flags & IPT_F_GOTO ? 'g' : 'j', jumpto);
Not related to your patch. We've been doing wrong flags handling, I'll
also push the patch attached.
> +
> + printf("\n");
> +}
> +
> void print_matches_and_target(struct iptables_command_state *cs,
> unsigned int format)
> {
> diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
> index 9df17bc..676cdca 100644
> --- a/iptables/nft-shared.h
> +++ b/iptables/nft-shared.h
> @@ -49,7 +49,7 @@ struct nft_family_ops {
> void (*parse_immediate)(const char *jumpto, bool nft_goto, void *data);
> void (*print_firewall)(struct nft_rule *r, unsigned int num,
> unsigned int format);
> - uint8_t (*save_firewall)(const struct iptables_command_state *cs,
> + void (*save_firewall)(const void *data,
> unsigned int format);
Please, next time also make sure coding you adjust the line above, so
we don't need to adjust it later on with coding style cleanup patches.
As said, I have fixes these things and pushed this patch to master.
Please, put a bit more care next time, thanks.
[-- Attachment #2: 0001-nft-compat-fix-IP6T_F_GOTO-flag-handling.patch --]
[-- Type: text/x-diff, Size: 4833 bytes --]
>From c2f26fc174da216f6ebb93349a5bd9e66bc070b3 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 11 Feb 2014 13:31:12 +0100
Subject: [PATCH iptables-compat] nft-compat: fix IP6T_F_GOTO flag handling
IPT_F_GOTO and IP6T_F_GOTO don't overlap, so this need special handling
to avoid misinterpretations.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
iptables/nft-ipv4.c | 8 +++++++-
iptables/nft-ipv6.c | 14 +++++++++-----
iptables/nft-shared.c | 5 +----
iptables/nft.c | 4 ++--
iptables/nft.h | 2 +-
5 files changed, 20 insertions(+), 13 deletions(-)
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 18a4c70..86a6ed9 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -76,7 +76,7 @@ static int nft_ipv4_add(struct nft_rule *r, void *data)
if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
return -1;
- return add_action(r, cs, cs->fw.ip.flags);
+ return add_action(r, cs, !!(cs->fw.ip.flags & IPT_F_GOTO));
}
static bool nft_ipv4_is_same(const void *data_a,
@@ -331,6 +331,12 @@ static void nft_ipv4_save_firewall(const void *data, unsigned int format)
save_matches_and_target(cs->matches, cs->target,
cs->jumpto, cs->fw.ip.flags, cs);
+
+ if (cs->target == NULL && strlen(cs->jumpto) > 0) {
+ printf("-%c %s", cs->fw.ip.flags & IPT_F_GOTO ? 'g' : 'j',
+ cs->jumpto);
+ }
+ printf("\n");
}
static void nft_ipv4_proto_parse(struct iptables_command_state *cs,
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index abc191e..d4dc3b9 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -59,7 +59,7 @@ static int nft_ipv6_add(struct nft_rule *r, void *data)
if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
return -1;
- return add_action(r, cs, cs->fw6.ipv6.flags);
+ return add_action(r, cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO));
}
static bool nft_ipv6_is_same(const void *data_a,
@@ -138,7 +138,7 @@ static void nft_ipv6_parse_immediate(const char *jumpto, bool nft_goto,
cs->jumpto = jumpto;
if (nft_goto)
- cs->fw6.ipv6.flags |= IPT_F_GOTO;
+ cs->fw6.ipv6.flags |= IP6T_F_GOTO;
}
static void print_ipv6_addr(const struct iptables_command_state *cs,
@@ -195,10 +195,8 @@ static void nft_ipv6_print_firewall(struct nft_rule *r, unsigned int num,
if (format & FMT_NOTABLE)
fputs(" ", stdout);
-#ifdef IPT_F_GOTO
- if (cs.fw6.ipv6.flags & IPT_F_GOTO)
+ if (cs.fw6.ipv6.flags & IP6T_F_GOTO)
printf("[goto] ");
-#endif
print_matches_and_target(&cs, format);
@@ -234,6 +232,12 @@ static void nft_ipv6_save_firewall(const void *data, unsigned int format)
save_matches_and_target(cs->matches, cs->target,
cs->jumpto, cs->fw6.ipv6.flags, cs);
+
+ if (cs->target == NULL && strlen(cs->jumpto) > 0) {
+ printf("-%c %s", cs->fw6.ipv6.flags & IP6T_F_GOTO ? 'g' : 'j',
+ cs->jumpto);
+ }
+ printf("\n");
}
/* These are invalid numbers as upper layer protocol */
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index dce8a34..ada71e6 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -648,10 +648,7 @@ void save_matches_and_target(struct xtables_rule_match *m,
if (target->save != NULL)
target->save(fw, target->t);
- } else if (strlen(jumpto) > 0)
- printf("-%c %s", flags & IPT_F_GOTO ? 'g' : 'j', jumpto);
-
- printf("\n");
+ }
}
void print_matches_and_target(struct iptables_command_state *cs,
diff --git a/iptables/nft.c b/iptables/nft.c
index 515d124..a45d599 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -864,7 +864,7 @@ int add_verdict(struct nft_rule *r, int verdict)
}
int add_action(struct nft_rule *r, struct iptables_command_state *cs,
- int ip_flags)
+ bool goto_set)
{
int ret = 0;
@@ -881,7 +881,7 @@ int add_action(struct nft_rule *r, struct iptables_command_state *cs,
ret = add_target(r, cs->target->t);
} else if (strlen(cs->jumpto) > 0) {
/* Not standard, then it's a go / jump to chain */
- if (ip_flags & IPT_F_GOTO)
+ if (goto_set)
ret = add_jumpto(r, cs->jumpto, NFT_GOTO);
else
ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
diff --git a/iptables/nft.h b/iptables/nft.h
index 8670f34..9248876 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -107,7 +107,7 @@ int add_verdict(struct nft_rule *r, int verdict);
int add_match(struct nft_rule *r, struct xt_entry_match *m);
int add_target(struct nft_rule *r, struct xt_entry_target *t);
int add_jumpto(struct nft_rule *r, const char *name, int verdict);
-int add_action(struct nft_rule *r, struct iptables_command_state *cs, int ip_flags);
+int add_action(struct nft_rule *r, struct iptables_command_state *cs, bool goto_set);
enum nft_rule_print {
NFT_RULE_APPEND,
--
1.7.10.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-02-11 12:49 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-02-10 15:49 [PATCH v2] nft-shared: adds save_matches_and_target Giuseppe Longo
2014-02-10 15:49 ` [PATCH v2] xtables-events: prints arp rules Giuseppe Longo
2014-02-11 12:05 ` Pablo Neira Ayuso
2014-02-11 12:49 ` [PATCH v2] nft-shared: adds save_matches_and_target Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).