[PATCH] iptables-translate: Initializing comment member in xt_xlate structure

[PATCH] iptables-translate: Initializing comment member in xt_xlate structure

[Guruswamy Basavaiah]

Initializing comment member in xt_xlate structure. 

Because of not initializing, when translating iptables command with multiple
ip addresses, In the translated commands --comment field is getting added.

Before fix:
inbhdhcp21574:basavaia$>sudo ./iptables-translate -A INPUT --source "40.0.0.1, 30.0.0.1" --dest "20.0.0.1, 60.0.0.1" -j ACCEPT
nft add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 20.0.0.1 counter accept
add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept
add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 20.0.0.1 counter comment \" \" accept
add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept

After fix:
inbhdhcp21574:basavaia$>sudo ./iptables-translate -A INPUT --source "40.0.0.1, 30.0.0.1" --dest "20.0.0.1, 60.0.0.1" -j ACCEPT
nft add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 20.0.0.1 counter accept
add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 60.0.0.1 counter accept
add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 20.0.0.1 counter accept
add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 60.0.0.1 counter accept

Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com>
---
 libxtables/xtables.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index fe24caa..cdb56c0 100644
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -2014,6 +2014,7 @@ struct xt_xlate *xt_xlate_alloc(int size)
 	xl->buf.size = size;
 	xl->buf.rem = size;
 	xl->buf.off = 0;
+	bzero(xl->comment, NFT_USERDATA_MAXLEN);
 
 	return xl;
 }
-- 
2.5.0

Re: [PATCH] iptables-translate: Initializing comment member in xt_xlate structure

[Pablo Neira Ayuso]

On Tue, Mar 29, 2016 at 12:34:36AM +0530, Guruswamy Basavaiah wrote:
> Initializing comment member in xt_xlate structure. 
> 
> Because of not initializing, when translating iptables command with multiple
> ip addresses, In the translated commands --comment field is getting added.
> 
> Before fix:
> inbhdhcp21574:basavaia$>sudo ./iptables-translate -A INPUT --source "40.0.0.1, 30.0.0.1" --dest "20.0.0.1, 60.0.0.1" -j ACCEPT
> nft add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 20.0.0.1 counter accept
> add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept
> add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 20.0.0.1 counter comment \" \" accept
> add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept

Thanks, I already pushed something similar yesterday.

http://git.netfilter.org/iptables/commit/?id=c93850d1d78c7040709d78aee5514c5c5035c4ab