| Message ID | 20160328190436.GA19755@localhost.localdomain |
|---|---|
| State | Not Applicable |
| Delegated to: | Pablo Neira |
| Headers | show |
On Tue, Mar 29, 2016 at 12:34:36AM +0530, Guruswamy Basavaiah wrote: > Initializing comment member in xt_xlate structure. > > Because of not initializing, when translating iptables command with multiple > ip addresses, In the translated commands --comment field is getting added. > > Before fix: > inbhdhcp21574:basavaia$>sudo ./iptables-translate -A INPUT --source "40.0.0.1, 30.0.0.1" --dest "20.0.0.1, 60.0.0.1" -j ACCEPT > nft add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 20.0.0.1 counter accept > add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept > add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 20.0.0.1 counter comment \" \" accept > add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept Thanks, I already pushed something similar yesterday. http://git.netfilter.org/iptables/commit/?id=c93850d1d78c7040709d78aee5514c5c5035c4ab -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/libxtables/xtables.c b/libxtables/xtables.c index fe24caa..cdb56c0 100644 --- a/libxtables/xtables.c +++ b/libxtables/xtables.c @@ -2014,6 +2014,7 @@ struct xt_xlate *xt_xlate_alloc(int size) xl->buf.size = size; xl->buf.rem = size; xl->buf.off = 0; + bzero(xl->comment, NFT_USERDATA_MAXLEN); return xl; }
Initializing comment member in xt_xlate structure. Because of not initializing, when translating iptables command with multiple ip addresses, In the translated commands --comment field is getting added. Before fix: inbhdhcp21574:basavaia$>sudo ./iptables-translate -A INPUT --source "40.0.0.1, 30.0.0.1" --dest "20.0.0.1, 60.0.0.1" -j ACCEPT nft add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 20.0.0.1 counter accept add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 20.0.0.1 counter comment \" \" accept add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 60.0.0.1 counter comment \" \" accept After fix: inbhdhcp21574:basavaia$>sudo ./iptables-translate -A INPUT --source "40.0.0.1, 30.0.0.1" --dest "20.0.0.1, 60.0.0.1" -j ACCEPT nft add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 20.0.0.1 counter accept add rule ip filter INPUT ip saddr 40.0.0.1 ip daddr 60.0.0.1 counter accept add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 20.0.0.1 counter accept add rule ip filter INPUT ip saddr 30.0.0.1 ip daddr 60.0.0.1 counter accept Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> --- libxtables/xtables.c | 1 + 1 file changed, 1 insertion(+)