xtables-compat: output -s,d first during save, just like iptables

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index e383cc9f5aa04e5e9e77af83d88015eabd1a293e..8193ac3c997fa70b33ef073d7ca041a5b8ada7e8 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -339,6 +339,11 @@ static void nft_ipv4_save_firewall(const void *data, unsigned int format)
 {
        const struct iptables_command_state *cs = data;
 
+       save_ipv4_addr('s', &cs->fw.ip.src, cs->fw.ip.smsk.s_addr,
+                      cs->fw.ip.invflags & IPT_INV_SRCIP);
+       save_ipv4_addr('d', &cs->fw.ip.dst, cs->fw.ip.dmsk.s_addr,
+                      cs->fw.ip.invflags & IPT_INV_DSTIP);
+
        save_firewall_details(cs, cs->fw.ip.invflags, cs->fw.ip.proto,
                              cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
                              cs->fw.ip.outiface, cs->fw.ip.outiface_mask);
@@ -349,11 +354,6 @@ static void nft_ipv4_save_firewall(const void *data, unsigned int format)
                printf("-f ");
        }
 
-       save_ipv4_addr('s', &cs->fw.ip.src, cs->fw.ip.smsk.s_addr,
-                      cs->fw.ip.invflags & IPT_INV_SRCIP);
-       save_ipv4_addr('d', &cs->fw.ip.dst, cs->fw.ip.dmsk.s_addr,
-                      cs->fw.ip.invflags & IPT_INV_DSTIP);
-
        save_matches_and_target(cs->matches, cs->target,
                                cs->jumpto, cs->fw.ip.flags, &cs->fw);
 

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 33f77ebf563728b56965071b0acb33b92dedb235..10c81d9549a2f50a6012991bcce6de25c7be222e 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -272,16 +272,16 @@ static void nft_ipv6_save_firewall(const void *data, unsigned int format)
 {
        const struct iptables_command_state *cs = data;
 
-       save_firewall_details(cs, cs->fw6.ipv6.invflags, cs->fw6.ipv6.proto,
-                             cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask,
-                             cs->fw6.ipv6.outiface,
-                             cs->fw6.ipv6.outiface_mask);
-
        save_ipv6_addr('s', &cs->fw6.ipv6.src,
                       cs->fw6.ipv6.invflags & IP6T_INV_SRCIP);
        save_ipv6_addr('d', &cs->fw6.ipv6.dst,
                       cs->fw6.ipv6.invflags & IP6T_INV_DSTIP);
 
+       save_firewall_details(cs, cs->fw6.ipv6.invflags, cs->fw6.ipv6.proto,
+                             cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask,
+                             cs->fw6.ipv6.outiface,
+                             cs->fw6.ipv6.outiface_mask);
+
        save_matches_and_target(cs->matches, cs->target,
                                cs->jumpto, cs->fw6.ipv6.flags, &cs->fw6);