iptables-translate: print nft iff there are more expanded rules to print

$ iptables-translate -I INPUT -s yahoo.com
nft insert rule ip filter INPUT ip saddr 98.139.183.24 counter
nft insert rule ip filter INPUT ip saddr 206.190.36.45 counter
nft insert rule ip filter INPUT ip saddr 98.138.253.109 counter
nft

This extra 'nft' print is incorrect, just print it if there are more
rules to be printed.

Reported-by: Alexander Alemayhu <alexander@alemayhu.com>
Tested-by: Alexander Alemayhu <alexander@alemayhu.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index d9885f20dce6a2f12eefdc781d3df44ba30b7367..00de019000f343240f36d854ca3bc40d9f13d950 100644 (file)
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -195,7 +195,7 @@ static int xlate(struct nft_handle *h, struct nft_xt_cmd_parse *p,
                        }
                        break;
                }
-               if (!cs->restore)
+               if (!cs->restore && i < args->s.naddrs - 1)
                        printf("nft ");
        }