Message ID | 1485422390-3938-1-git-send-email-mayhs11saini@gmail.com |
---|---|
State | Accepted |
Delegated to: | Pablo Neira |
Headers | show |
Hi! On Thu, Jan 26, 2017 at 2:49 PM, Shyam Saini <mayhs11saini@gmail.com> wrote: > Fix wrong appending of jump verdict after the comment > > For example: > $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" > nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT > > Note that even without comment with double-quotes (i.e. --comment > "foobar"), it will add quotes: > > $ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment > nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop > > Attempting to apply the translated/generated rule will result to: > > $ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT > <cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon > add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT > > After this patch > $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" > nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\" > which is correct translation > I get the following: sudo nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\" <cmdline>:1:1-127: Error: Could not process rule: Operation not supported add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment "foobar" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Shivani > Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> > --- > iptables/nft-ipv4.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c > index 52b1bed..e5947a7 100644 > --- a/iptables/nft-ipv4.c > +++ b/iptables/nft-ipv4.c > @@ -489,12 +489,11 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) > > /* Always add counters per rule, as in iptables */ > xt_xlate_add(xl, "counter "); > + ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); > > comment = xt_xlate_get_comment(xl); > if (comment) > - xt_xlate_add(xl, "comment %s", comment); > - > - ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); > + xt_xlate_add(xl, " comment %s", comment); > > return ret; > } > -- > 2.7.4 > > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Jan 26, 2017 at 2:49 PM, Shyam Saini <mayhs11saini@gmail.com> wrote: > Fix wrong appending of jump verdict after the comment > > For example: > $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" > nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT > > Note that even without comment with double-quotes (i.e. --comment > "foobar"), it will add quotes: > > $ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment > nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop > > Attempting to apply the translated/generated rule will result to: > > $ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT > <cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon > add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT > > After this patch > $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" > nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\" > which is correct translation > > Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Reviewed-by: Shivani Bhardwaj <shivanib134@gmail.com> It does get accepted by nft. Sorry about the last mail. You could probably send out similar patch for ip6 too. Shivani > --- > iptables/nft-ipv4.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c > index 52b1bed..e5947a7 100644 > --- a/iptables/nft-ipv4.c > +++ b/iptables/nft-ipv4.c > @@ -489,12 +489,11 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) > > /* Always add counters per rule, as in iptables */ > xt_xlate_add(xl, "counter "); > + ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); > > comment = xt_xlate_get_comment(xl); > if (comment) > - xt_xlate_add(xl, "comment %s", comment); > - > - ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); > + xt_xlate_add(xl, " comment %s", comment); > > return ret; > } > -- > 2.7.4 > > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Jan 26, 2017 at 05:06:56PM +0530, Shivani Bhardwaj wrote: > On Thu, Jan 26, 2017 at 2:49 PM, Shyam Saini <mayhs11saini@gmail.com> wrote: > > Fix wrong appending of jump verdict after the comment > > > > For example: > > $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" > > nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT > > > > Note that even without comment with double-quotes (i.e. --comment > > "foobar"), it will add quotes: > > > > $ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment > > nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop > > > > Attempting to apply the translated/generated rule will result to: > > > > $ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT > > <cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon > > add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT > > > > After this patch > > $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" > > nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\" > > which is correct translation > > > > Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> > > Reviewed-by: Shivani Bhardwaj <shivanib134@gmail.com> > > It does get accepted by nft. Sorry about the last mail. > You could probably send out similar patch for ip6 too. I have mangled your patch to include the missing IPv6 chunk. So this patch has been applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 52b1bed..e5947a7 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -489,12 +489,11 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) /* Always add counters per rule, as in iptables */ xt_xlate_add(xl, "counter "); + ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); comment = xt_xlate_get_comment(xl); if (comment) - xt_xlate_add(xl, "comment %s", comment); - - ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl); + xt_xlate_add(xl, " comment %s", comment); return ret; }
Fix wrong appending of jump verdict after the comment For example: $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT Note that even without comment with double-quotes (i.e. --comment "foobar"), it will add quotes: $ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop Attempting to apply the translated/generated rule will result to: $ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT <cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT After this patch $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\" which is correct translation Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> --- iptables/nft-ipv4.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)