iptables: Fix setting of ipv6 counters

When setting counters using ip6tables-nft -c X Y the X and Y values were
not stored.

This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but
applied to the nft variant of ipv6 not the legacy.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647
Fixes: 0391677c1a0b2 ("xtables: add IPv6 support")
Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
index c98bdd6e501aa61f1383bffc3aa2857726160e45..09e39927ef3904fbc60d987b6ce47a98fb13a25b 100755 (executable)
--- a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
+++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
@@ -3,7 +3,7 @@
 set -e
 
 $XT_MULTI ip6tables -N foo
-$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT
+$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42
 $XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo
 $XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
 
@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0
 -P FORWARD ACCEPT -c 0 0
 -P OUTPUT ACCEPT -c 0 0
 -N foo
--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
 -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
 
 diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S)
@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT
 diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
 
 EXPECT='-P FORWARD ACCEPT -c 0 0
--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
 -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
 
 diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD)

diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
index d335d44257a499a33984b4da2c9abe4b8eb4c4ab..d07bd151be76bea8e1ff96971ca68005cbee4c5d 100755 (executable)
--- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
@@ -3,7 +3,7 @@
 set -e
 
 $XT_MULTI iptables -N foo
-$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT
+$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42
 $XT_MULTI iptables -A FORWARD -i eth42 -o eth23 -g foo
 $XT_MULTI iptables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
 
@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0
 -P FORWARD ACCEPT -c 0 0
 -P OUTPUT ACCEPT -c 0 0
 -N foo
--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
 -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
 
 diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S)
@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT
 diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -S FORWARD)
 
 EXPECT='-P FORWARD ACCEPT -c 0 0
--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
 -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
 
 diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S FORWARD)

diff --git a/iptables/xshared.c b/iptables/xshared.c
index a235010311d93ec9d16753090756216fa5ac006a..28c65faed7b25f01ac9ea9e5e1717d96365d808e 100644 (file)
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -1982,6 +1982,9 @@ void ipv6_post_parse(int command, struct iptables_command_state *cs,
        if (args->goto_set)
                cs->fw6.ipv6.flags |= IP6T_F_GOTO;
 
+       /* nft-variants use cs->counters, legacy uses cs->fw6.counters */
+       cs->counters.pcnt = args->pcnt_cnt;
+       cs->counters.bcnt = args->bcnt_cnt;
        cs->fw6.counters.pcnt = args->pcnt_cnt;
        cs->fw6.counters.bcnt = args->bcnt_cnt;