xshared: Entirely ignore interface masks when saving rules

Rule printing code does this for more than 20 years now, assume it's
safe to rely upon the wildcard interface name to contain a '+' suffix.

Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
index 08da04b4567870bae1526d8a3f98f2180634c2fd..21cd8018926414cb3975d3d0c945403661414699 100644 (file)
--- a/iptables/ip6tables.c
+++ b/iptables/ip6tables.c
@@ -509,8 +509,7 @@ void print_rule6(const struct ip6t_entry *e,
        save_ipv6_addr('d', &e->ipv6.dst, &e->ipv6.dmsk,
                       e->ipv6.invflags & IP6T_INV_DSTIP);
 
-       save_rule_details(e->ipv6.iniface, e->ipv6.iniface_mask,
-                         e->ipv6.outiface, e->ipv6.outiface_mask,
+       save_rule_details(e->ipv6.iniface, e->ipv6.outiface,
                          e->ipv6.proto, 0, e->ipv6.invflags);
 
 #if 0

diff --git a/iptables/iptables.c b/iptables/iptables.c
index a73e8eed9028a286fc6ee83d02f1752731779980..ce65c30ad0b15d9cba12951f53dd5b7c28619747 100644 (file)
--- a/iptables/iptables.c
+++ b/iptables/iptables.c
@@ -516,8 +516,7 @@ void print_rule4(const struct ipt_entry *e,
        save_ipv4_addr('d', &e->ip.dst, &e->ip.dmsk,
                        e->ip.invflags & IPT_INV_DSTIP);
 
-       save_rule_details(e->ip.iniface, e->ip.iniface_mask,
-                         e->ip.outiface, e->ip.outiface_mask,
+       save_rule_details(e->ip.iniface, e->ip.outiface,
                          e->ip.proto, e->ip.flags & IPT_F_FRAG,
                          e->ip.invflags);
 

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 7fb71ed4a8056f40e75ba1222662c01903c6e7f6..c140ffde34b625d6caab9e802386e11b22139992 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -161,8 +161,7 @@ static void nft_ipv4_save_rule(const struct iptables_command_state *cs,
        save_ipv4_addr('d', &cs->fw.ip.dst, &cs->fw.ip.dmsk,
                       cs->fw.ip.invflags & IPT_INV_DSTIP);
 
-       save_rule_details(cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
-                         cs->fw.ip.outiface, cs->fw.ip.outiface_mask,
+       save_rule_details(cs->fw.ip.iniface, cs->fw.ip.outiface,
                          cs->fw.ip.proto, cs->fw.ip.flags & IPT_F_FRAG,
                          cs->fw.ip.invflags);
 

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index bb417356629a9bcc54d4abbe2864cc4fa52afa6a..4bf4f54f18a00f8174d2fc3ce00d44515ae12ff8 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -147,8 +147,7 @@ static void nft_ipv6_save_rule(const struct iptables_command_state *cs,
        save_ipv6_addr('d', &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
                       cs->fw6.ipv6.invflags & IP6T_INV_DSTIP);
 
-       save_rule_details(cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask,
-                         cs->fw6.ipv6.outiface, cs->fw6.ipv6.outiface_mask,
+       save_rule_details(cs->fw6.ipv6.iniface, cs->fw6.ipv6.outiface,
                          cs->fw6.ipv6.proto, 0, cs->fw6.ipv6.invflags);
 
        save_matches_and_target(cs, cs->fw6.ipv6.flags & IP6T_F_GOTO,

diff --git a/iptables/xshared.c b/iptables/xshared.c
index ca17479811df3f851babbb0183432f82d468cced..839a5bb68776c5f2c2253a829794abcb01071e37 100644 (file)
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -757,29 +757,12 @@ void print_ifaces(const char *iniface, const char *outiface, uint8_t invflags,
        printf(FMT("%-6s ", "out %s "), iface);
 }
 
-/* This assumes that mask is contiguous, and byte-bounded. */
-void save_iface(char letter, const char *iface,
-               const unsigned char *mask, int invert)
+void save_iface(char letter, const char *iface, int invert)
 {
-       unsigned int i;
-
-       if (mask[0] == 0)
+       if (!strlen(iface) || !strcmp(iface, "+"))
                return;
 
-       printf("%s -%c ", invert ? " !" : "", letter);
-
-       for (i = 0; i < IFNAMSIZ; i++) {
-               if (mask[i] != 0) {
-                       if (iface[i] != '\0')
-                               printf("%c", iface[i]);
-               } else {
-                       /* we can access iface[i-1] here, because
-                        * a few lines above we make sure that mask[0] != 0 */
-                       if (iface[i-1] != '\0')
-                               printf("+");
-                       break;
-               }
-       }
+       printf("%s -%c %s", invert ? " !" : "", letter, iface);
 }
 
 static void command_match(struct iptables_command_state *cs, bool invert)
@@ -1066,17 +1049,14 @@ void print_rule_details(unsigned int linenum, const struct xt_counters *ctrs,
                printf(FMT("%-4s ", "%s "), pname);
 }
 
-void save_rule_details(const char *iniface, unsigned const char *iniface_mask,
-                      const char *outiface, unsigned const char *outiface_mask,
+void save_rule_details(const char *iniface, const char *outiface,
                       uint16_t proto, int frag, uint8_t invflags)
 {
        if (iniface != NULL) {
-               save_iface('i', iniface, iniface_mask,
-                           invflags & IPT_INV_VIA_IN);
+               save_iface('i', iniface, invflags & IPT_INV_VIA_IN);
        }
        if (outiface != NULL) {
-               save_iface('o', outiface, outiface_mask,
-                           invflags & IPT_INV_VIA_OUT);
+               save_iface('o', outiface, invflags & IPT_INV_VIA_OUT);
        }
 
        if (proto > 0) {

diff --git a/iptables/xshared.h b/iptables/xshared.h
index 28efd73cf470a64cfc2f6a330bdb4b4d995aee31..952fa8ab95fec481ade32e273ee16fb6d0377861 100644 (file)
--- a/iptables/xshared.h
+++ b/iptables/xshared.h
@@ -212,8 +212,7 @@ void save_ipv6_addr(char letter, const struct in6_addr *addr,
 
 void print_ifaces(const char *iniface, const char *outiface, uint8_t invflags,
                  unsigned int format);
-void save_iface(char letter, const char *iface,
-               const unsigned char *mask, int invert);
+void save_iface(char letter, const char *iface, int invert);
 
 void print_fragment(unsigned int flags, unsigned int invflags,
                    unsigned int format, bool fake);
@@ -225,8 +224,7 @@ void assert_valid_chain_name(const char *chainname);
 void print_rule_details(unsigned int linenum, const struct xt_counters *ctrs,
                        const char *targname, uint8_t proto, uint8_t flags,
                        uint8_t invflags, unsigned int format);
-void save_rule_details(const char *iniface, unsigned const char *iniface_mask,
-                      const char *outiface, unsigned const char *outiface_mask,
+void save_rule_details(const char *iniface, const char *outiface,
                       uint16_t proto, int frag, uint8_t invflags);
 
 int print_match_save(const struct xt_entry_match *e, const void *ip);