iptables: take masks into consideration for replace command

The two commands:

-A OUPUT -d 10.11.12.13/32 -j LOG
-R OUTPUT 1 -j LOG -d 10.11.12.13

will replace 10.11.12.13/32 by 10.11.12.13/0, which is not right.
(No regression, this problem was there forever.)

Reported-by: Werner Pawlitschko <werner.pawlitschko@arcor.de>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

diff --git a/ip6tables.c b/ip6tables.c
index f6daa51c2ad49091d07d7483a51da4e9d5c64e76..e2359dfe4700a2738b92408ef3913e30dd4acd15 100644 (file)
--- a/ip6tables.c
+++ b/ip6tables.c
@@ -758,13 +758,15 @@ static int
 replace_entry(const ip6t_chainlabel chain,
              struct ip6t_entry *fw,
              unsigned int rulenum,
-             const struct in6_addr *saddr,
-             const struct in6_addr *daddr,
+             const struct in6_addr *saddr, const struct in6_addr *smask,
+             const struct in6_addr *daddr, const struct in6_addr *dmask,
              int verbose,
              struct ip6tc_handle *handle)
 {
        fw->ipv6.src = *saddr;
        fw->ipv6.dst = *daddr;
+       fw->ipv6.smsk = *smask;
+       fw->ipv6.dmsk = *dmask;
 
        if (verbose)
                print_firewall_line(fw, handle);
@@ -1947,8 +1949,8 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand
                break;
        case CMD_REPLACE:
                ret = replace_entry(chain, e, rulenum - 1,
-                                   saddrs, daddrs, options&OPT_VERBOSE,
-                                   *handle);
+                                   saddrs, smasks, daddrs, dmasks,
+                                   options&OPT_VERBOSE, *handle);
                break;
        case CMD_INSERT:
                ret = insert_entry(chain, e, rulenum - 1,

diff --git a/iptables.c b/iptables.c
index a69aab3061ee4ce103f95394728d3440e59aac61..08eb1345f220617789a06e3f1c7a24597a643512 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -760,13 +760,15 @@ static int
 replace_entry(const ipt_chainlabel chain,
              struct ipt_entry *fw,
              unsigned int rulenum,
-             const struct in_addr *saddr,
-             const struct in_addr *daddr,
+             const struct in_addr *saddr, const struct in_addr *smask,
+             const struct in_addr *daddr, const struct in_addr *dmask,
              int verbose,
              struct iptc_handle *handle)
 {
        fw->ip.src.s_addr = saddr->s_addr;
        fw->ip.dst.s_addr = daddr->s_addr;
+       fw->ip.smsk.s_addr = smask->s_addr;
+       fw->ip.dmsk.s_addr = dmask->s_addr;
 
        if (verbose)
                print_firewall_line(fw, handle);
@@ -1988,8 +1990,8 @@ int do_command(int argc, char *argv[], char **table, struct iptc_handle **handle
                break;
        case CMD_REPLACE:
                ret = replace_entry(chain, e, rulenum - 1,
-                                   saddrs, daddrs, options&OPT_VERBOSE,
-                                   *handle);
+                                   saddrs, smasks, daddrs, dmasks,
+                                   options&OPT_VERBOSE, *handle);
                break;
        case CMD_INSERT:
                ret = insert_entry(chain, e, rulenum - 1,