]> git.ipfire.org Git - thirdparty/iptables.git/commit
ebtables-compat: fix ACCEPT printing by simplifying logic
authorArturo Borrero <arturo.borrero.glez@gmail.com>
Tue, 13 Jan 2015 17:36:10 +0000 (18:36 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 28 Jan 2015 16:23:31 +0000 (17:23 +0100)
commit457ed5e1231cf433b239fd10ccf3d976805eb4d8
tree6aee34214c8d97cecdb7273f04e13b6731ad2890
parent3397fb3be98ff90ff3d6788fe08d81b65d7b027c
ebtables-compat: fix ACCEPT printing by simplifying logic

The commit bc543af ("ebtables-compat: fix segfault in rules w/o target")
doesn't handle all possible cases of target printing, and ACCEPT is left
behind.

BTW, the logic of target (-j XXX) printing is a bit weird. This patch
simplifies it.

I assume:
 * cs->jumpto is only filled by nft_immediate.
 * cs->target is only filled by nft_target.

So we end with these cases:
 * nft_immediate contains a 'standard' target (ACCEPT, DROP, CONTINUE, RETURN, chain)
  Then cs->jumpto contains the target already. We have the rule.
 * No standard target. If nft_target contains a target, try to load it.
 * Neither nft_target nor nft_immediate exist. Then, assume CONTINUE.

The printing path is then straight forward: either cs.jumpto or cs.target
contains the target.

As there isn't support for target extensions yet, there is no way to test the
nft_target (cs.target) path.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables/nft-bridge.c