iptables-translate: add in/out ifname wildcard match translation to nft

In iptables, "-i eth+" means match all in ifname with the prefix "eth".
But in nftables, this was changed to "iifname eth*". So we should handle
this subtle difference.

Apply this patch, translation will become:
  # iptables-translate -A INPUT -i eth+
  nft add rule ip filter INPUT iifname eth* counter
  # ip6tables-translate -A OUTPUT ! -o eth+
  nft add rule ip6 filter OUTPUT oifname != eth* counter

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 814ca14ddcca9158deaa0709b311adbca21f6898..50706cb04d529e34d80fbcf33beff146f92a9b97 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -444,16 +444,10 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
        const char *comment;
        int ret;
 
-       if (cs->fw.ip.iniface[0] != '\0') {
-               xt_xlate_add(xl, "iifname %s%s ",
-                          cs->fw.ip.invflags & IPT_INV_VIA_IN ? "!= " : "",
-                          cs->fw.ip.iniface);
-       }
-       if (cs->fw.ip.outiface[0] != '\0') {
-               xt_xlate_add(xl, "oifname %s%s ",
-                          cs->fw.ip.invflags & IPT_INV_VIA_OUT? "!= " : "",
-                          cs->fw.ip.outiface);
-       }
+       xlate_ifname(xl, "iifname", cs->fw.ip.iniface,
+                    cs->fw.ip.invflags & IPT_INV_VIA_IN);
+       xlate_ifname(xl, "oifname", cs->fw.ip.outiface,
+                    cs->fw.ip.invflags & IPT_INV_VIA_OUT);
 
        if (cs->fw.ip.flags & IPT_F_FRAG) {
                xt_xlate_add(xl, "ip frag-off %s%x ",

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index bfbf8dff218c8d619b9648b28adc12cf92247d0e..8ca523c89f5bebade74fa2ddc018871113148252 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -404,18 +404,10 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
        const char *comment;
        int ret;
 
-       if (cs->fw6.ipv6.iniface[0] != '\0') {
-               xt_xlate_add(xl, "iifname %s%s ",
-                          cs->fw6.ipv6.invflags & IP6T_INV_VIA_IN ?
-                               "!= " : "",
-                          cs->fw6.ipv6.iniface);
-       }
-       if (cs->fw6.ipv6.outiface[0] != '\0') {
-               xt_xlate_add(xl, "oifname %s%s ",
-                          cs->fw6.ipv6.invflags & IP6T_INV_VIA_OUT ?
-                               "!= " : "",
-                          cs->fw6.ipv6.outiface);
-       }
+       xlate_ifname(xl, "iifname", cs->fw6.ipv6.iniface,
+                    cs->fw6.ipv6.invflags & IP6T_INV_VIA_IN);
+       xlate_ifname(xl, "oifname", cs->fw6.ipv6.outiface,
+                    cs->fw6.ipv6.invflags & IP6T_INV_VIA_OUT);
 
        if (cs->fw6.ipv6.proto != 0) {
                const struct protoent *pent =

diff --git a/iptables/nft.h b/iptables/nft.h
index 9e02eeb14231824728e84bffb12e651149816f40..8867434030442b47cff821479c2b3610f55bf0bf 100644 (file)
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -165,6 +165,8 @@ bool xlate_find_match(const struct iptables_command_state *cs, const char *p_nam
 int xlate_matches(const struct iptables_command_state *cs, struct xt_xlate *xl);
 int xlate_action(const struct iptables_command_state *cs, bool goto_set,
                 struct xt_xlate *xl);
+void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
+                 bool invert);
 
 /*
  * ARP

diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 9044d27ca6b86e4fb1eb53f6140e83ed8d168fff..3c577ed23f2dc8929f47cb4e89582c6d798dbd94 100644 (file)
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -34,6 +34,23 @@
 #include "xshared.h"
 #include "nft-shared.h"
 
+void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
+                 bool invert)
+{
+       char iface[IFNAMSIZ];
+       int ifaclen;
+
+       if (ifname[0] == '\0')
+               return;
+
+       strcpy(iface, ifname);
+       ifaclen = strlen(iface);
+       if (iface[ifaclen - 1] == '+')
+               iface[ifaclen - 1] = '*';
+
+       xt_xlate_add(xl, "%s %s%s ", nftmeta, invert ? "!= " : "", iface);
+}
+
 int xlate_action(const struct iptables_command_state *cs, bool goto_set,
                 struct xt_xlate *xl)
 {