diff mbox series

[xtables,01/10] xtables-translate: fix xlate command line

Message ID 20180509185926.3333-2-fw@strlen.de
State Accepted
Delegated to: Pablo Neira
Headers show
Series xtables: ebtables fixes | expand

Commit Message

Florian Westphal May 9, 2018, 6:59 p.m. UTC 
kernel would reject such syntax as it enforces
-p and --ip(6)-protocol, so add those as well, no point in testing
something the kernel would not accept
(This doesn't affect the translations).

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 extensions/libebt_ip.txlate   | 18 +++++++++---------
 extensions/libebt_ip6.txlate  | 20 ++++++++++----------
 extensions/libebt_vlan.txlate |  8 ++++----
 3 files changed, 23 insertions(+), 23 deletions(-)
diff mbox series

Patch

diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate
index cbe05f4f11ff..b5882c342b04 100644
--- a/extensions/libebt_ip.txlate
+++ b/extensions/libebt_ip.txlate
@@ -1,26 +1,26 @@ 
-ebtables-translate -A FORWARD --ip-src ! 192.168.0.0/24 -j ACCEPT
+ebtables-translate -A FORWARD -p ip --ip-src ! 192.168.0.0/24 -j ACCEPT
 nft add rule bridge filter FORWARD ip saddr != 192.168.0.0/24 counter accept
 
-ebtables-translate -I FORWARD --ip-dst 10.0.0.1
+ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1
 nft insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter
 
-ebtables-translate -I OUTPUT 3 -o eth0 --ip-tos 0xff
+ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff
 nft insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter
 
-ebtables-translate -A FORWARD --ip-proto tcp --ip-dport 22
+ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22
 nft add rule bridge filter FORWARD tcp dport 22 counter
 
-ebtables-translate -A FORWARD --ip-proto udp --ip-sport 1024:65535
+ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535
 nft add rule bridge filter FORWARD udp sport 1024-65535 counter
 
-ebtables-translate -A FORWARD --ip-proto 253
+ebtables-translate -A FORWARD -p ip --ip-proto 253
 nft add rule bridge filter FORWARD ip protocol 253 counter
 
-ebtables-translate -A FORWARD --ip-icmp-type "echo-request"
+ebtables-translate -A FORWARD -p ip --ip-protocol icmp --ip-icmp-type "echo-request"
 nft add rule bridge filter FORWARD icmp type 8 counter
 
-ebtables-translate -A FORWARD --ip-icmp-type 1/1
+ebtables-translate -A FORWARD -p ip --ip-proto icmp --ip-icmp-type 1/1
 nft add rule bridge filter FORWARD icmp type 1 icmp code 1 counter
 
-ebtables-translate -A FORWARD --ip-icmp-type ! 1:10
+ebtables-translate -A FORWARD -p ip --ip-protocol icmp --ip-icmp-type ! 1:10
 nft add rule bridge filter FORWARD icmp type != 1-10 counter
diff --git a/extensions/libebt_ip6.txlate b/extensions/libebt_ip6.txlate
index 0f2efdf8fc07..0271734c9b09 100644
--- a/extensions/libebt_ip6.txlate
+++ b/extensions/libebt_ip6.txlate
@@ -1,29 +1,29 @@ 
-ebtables-translate -A FORWARD --ip6-src ! dead::beef/64 -j ACCEPT
+ebtables-translate -A FORWARD -p ip6 --ip6-src ! dead::beef/64 -j ACCEPT
 nft add rule bridge filter FORWARD ip6 saddr != dead::/64 counter accept
 
-ebtables-translate -A FORWARD ! --ip6-dst dead:beef::/64 -j ACCEPT
+ebtables-translate -A FORWARD -p ip6 ! --ip6-dst dead:beef::/64 -j ACCEPT
 nft add rule bridge filter FORWARD ip6 daddr != dead:beef::/64 counter accept
 
-ebtables-translate -I FORWARD --ip6-dst f00:ba::
+ebtables-translate -I FORWARD -p ip6 --ip6-dst f00:ba::
 nft insert rule bridge filter FORWARD ip6 daddr f00:ba:: counter
 
-ebtables-translate -I OUTPUT -o eth0 --ip6-tclass 0xff
+ebtables-translate -I OUTPUT -o eth0 -p ip6 --ip6-tclass 0xff
 nft insert rule bridge filter OUTPUT oifname "eth0" ip6 dscp 0x3f counter
 
-ebtables-translate -A FORWARD --ip6-proto tcp --ip6-dport 22
+ebtables-translate -A FORWARD -p ip6 --ip6-proto tcp --ip6-dport 22
 nft add rule bridge filter FORWARD ether type ip6 tcp dport 22 counter
 
-ebtables-translate -A FORWARD --ip6-proto udp --ip6-sport 1024:65535
+ebtables-translate -A FORWARD -p ip6 --ip6-proto udp --ip6-sport 1024:65535
 nft add rule bridge filter FORWARD ether type ip6 udp sport 1024-65535 counter
 
-ebtables-translate -A FORWARD --ip6-proto 253
+ebtables-translate -A FORWARD -p ip6 --ip6-proto 253
 nft add rule bridge filter FORWARD ether type ip6 meta l4proto 253 counter
 
-ebtables-translate -A FORWARD --ip6-icmp-type "echo-request"
+ebtables-translate -A FORWARD -p ip6  --ip6-protocol icmpv6 --ip6-icmp-type "echo-request"
 nft add rule bridge filter FORWARD icmpv6 type 128 counter
 
-ebtables-translate -A FORWARD --ip6-icmp-type 1/1
+ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6  --ip6-icmp-type 1/1
 nft add rule bridge filter FORWARD icmpv6 type 1 icmpv6 code 1 counter
 
-ebtables-translate -A FORWARD --ip6-icmp-type ! 1:10
+ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type ! 1:10
 nft add rule bridge filter FORWARD icmpv6 type != 1-10 counter
diff --git a/extensions/libebt_vlan.txlate b/extensions/libebt_vlan.txlate
index fe1ec141580a..2ab62d5335ab 100644
--- a/extensions/libebt_vlan.txlate
+++ b/extensions/libebt_vlan.txlate
@@ -1,11 +1,11 @@ 
-ebtables-translate -A INPUT --vlan-id 42
+ebtables-translate -A INPUT -p 802_1Q --vlan-id 42
 nft add rule bridge filter INPUT vlan id 42 counter
 
-ebtables-translate -A INPUT --vlan-prio ! 1
+ebtables-translate -A INPUT -p 802_1Q --vlan-prio ! 1
 nft add rule bridge filter INPUT vlan pcp != 1 counter
 
-ebtables-translate -A INPUT --vlan-encap ip
+ebtables-translate -A INPUT -p 802_1Q --vlan-encap ip
 nft add rule bridge filter INPUT vlan type 0x0800 counter
 
-ebtables-translate -A INPUT --vlan-encap ipv6 ! --vlan-id 1
+ebtables-translate -A INPUT -p 802_1Q --vlan-encap ipv6 ! --vlan-id 1
 nft add rule bridge filter INPUT vlan id != 1 vlan type 0x86dd counter