xtables-translate: Fix for interfaces with asterisk mid-string

For nft, asterisk is special at end of the interface name only. Escaping
it mid-string makes the escape char part of the interface name, so avoid
this.

In the test case, also drop the ticks around interface names in
*-translate command - since there's no shell involved which would eat
them, they become part of the interface name.

Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases")
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/extensions/generic.txlate b/extensions/generic.txlate
index 7e879fd526bb13f73c2dce4b3da556112a4c1464..d7ddf6a39762e9808652f9a1a2f1355e49cce58e 100644 (file)
--- a/extensions/generic.txlate
+++ b/extensions/generic.txlate
@@ -74,17 +74,17 @@ ebtables-translate -I INPUT -p ! Length
 nft 'insert rule bridge filter INPUT ether type >= 0x0600 counter'
 
 # asterisk is not special in iptables and it is even a valid interface name
-iptables-translate -A FORWARD -i '*' -o 'eth*foo'
-nft 'add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter'
+iptables-translate -A FORWARD -i * -o eth*foo
+nft 'add rule ip filter FORWARD iifname "\*" oifname "eth*foo" counter'
 
-# escape all asterisks but translate only the first plus character
-iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++'
-nft 'add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter'
+# escape only suffix asterisk and translate only the last plus character
+iptables-translate -A FORWARD -i eth*foo*+ -o eth++
+nft 'add rule ip filter FORWARD iifname "eth*foo**" oifname "eth+*" counter'
 
 # skip for always matching interface names
-iptables-translate -A FORWARD -i '+'
+iptables-translate -A FORWARD -i +
 nft 'add rule ip filter FORWARD counter'
 
 # match against invalid interface name to simulate never matching rule
-iptables-translate -A FORWARD ! -i '+'
+iptables-translate -A FORWARD ! -i +
 nft 'add rule ip filter FORWARD iifname "INVAL/D" counter'

diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 102973a6240a761f1551911306fdb9a7b6487148..22b2fbc869eedabfe434529c3a7a46302e1fe524 100644 (file)
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -41,7 +41,9 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
        for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
                switch (ifname[i]) {
                case '*':
-                       iface[j++] = '\\';
+                       /* asterisk is non-special mid-string */
+                       if (i == ifaclen - 1)
+                               iface[j++] = '\\';
                        /* fall through */
                default:
                        iface[j] = ifname[i];