Previous to this patch, if we add a rule like this:
nft add rule filter test ip saddr { 1.1.1.1-2.2.2.2 }
The monitor operation output shows:
add rule ip filter test ip saddr { 0.0.0.0, 1.1.1.1, 2.2.2.3}
The fix suggested by Pablo is to call interval_map_decompose().
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
return MNL_CB_OK;
}
+static void rule_map_decompose_cb(struct set *s, void *data)
+{
+ if (s->flags & NFT_SET_INTERVAL)
+ interval_map_decompose(s->init);
+}
+
static int netlink_events_rule_cb(const struct nlmsghdr *nlh, int type,
struct netlink_mon_handler *monh)
{
if (type == NFT_MSG_NEWRULE) {
r = netlink_delinearize_rule(monh->ctx, nlr);
+ nlr_for_each_set(nlr, rule_map_decompose_cb, NULL);
printf("add rule %s %s %s", family, table, chain);
rule_print(r);