[PATCH] extensions: libxt_mac: Add translation to nft

[PATCH] extensions: libxt_mac: Add translation to nft

[Shivani Bhardwaj]

Add translation for module mac to nftables.

Examples:

$ sudo iptables-translate -A INPUT -m mac --mac-source 0a:12:3e:4f:b2:c6 -j DROP
nft add rule ip filter INPUT  ether saddr 0A:12:3E:4F:B2:C6 counter drop

$ sudo iptables-translate -A INPUT -p tcp --dport 80 -m mac --mac-source 0a:12:3e:4f:b2:c6 -j ACCEPT
nft add rule ip filter INPUT tcp dport 80  ether saddr 0A:12:3E:4F:B2:C6 counter accept

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libxt_mac.c | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/extensions/libxt_mac.c b/extensions/libxt_mac.c
index f171d15..8aae700 100644
--- a/extensions/libxt_mac.c
+++ b/extensions/libxt_mac.c
@@ -50,11 +50,12 @@ static void
 mac_print(const void *ip, const struct xt_entry_match *match, int numeric)
 {
 	const struct xt_mac_info *info = (void *)match->data;
+
 	printf(" MAC");
 
 	if (info->invert)
 		printf(" !");
-	
+
 	print_mac(info->srcaddr);
 }
 
@@ -69,9 +70,34 @@ static void mac_save(const void *ip, const struct xt_entry_match *match)
 	print_mac(info->srcaddr);
 }
 
+static void print_mac_xlate(const unsigned char *macaddress,
+			    struct xt_buf *buf)
+{
+	unsigned int i;
+
+	xt_buf_add(buf, " %02X", macaddress[0]);
+	for (i = 1; i < ETH_ALEN; ++i)
+		xt_buf_add(buf, ":%02X", macaddress[i]);
+	xt_buf_add(buf, " ");
+}
+
+static int mac_xlate(const struct xt_entry_match *match,
+		     struct xt_buf *buf, int numeric)
+{
+	const struct xt_mac_info *info = (void *)match->data;
+
+	if (info->invert)
+		xt_buf_add(buf, " !=");
+
+	xt_buf_add(buf, " ether saddr");
+	print_mac_xlate(info->srcaddr, buf);
+
+	return 1;
+}
+
 static struct xtables_match mac_match = {
 	.family		= NFPROTO_UNSPEC,
- 	.name		= "mac",
+	.name		= "mac",
 	.version	= XTABLES_VERSION,
 	.size		= XT_ALIGN(sizeof(struct xt_mac_info)),
 	.userspacesize	= XT_ALIGN(sizeof(struct xt_mac_info)),
@@ -80,6 +106,7 @@ static struct xtables_match mac_match = {
 	.print		= mac_print,
 	.save		= mac_save,
 	.x6_options	= mac_opts,
+	.xlate		= mac_xlate,
 };
 
 void _init(void)
-- 
1.9.1

Re: [PATCH] extensions: libxt_mac: Add translation to nft

[Pablo Neira Ayuso]

On Tue, Dec 22, 2015 at 06:06:17PM +0530, Shivani Bhardwaj wrote:
> Add translation for module mac to nftables.
> 
> Examples:
> 
> $ sudo iptables-translate -A INPUT -m mac --mac-source 0a:12:3e:4f:b2:c6 -j DROP
> nft add rule ip filter INPUT  ether saddr 0A:12:3E:4F:B2:C6 counter drop
> 
> $ sudo iptables-translate -A INPUT -p tcp --dport 80 -m mac --mac-source 0a:12:3e:4f:b2:c6 -j ACCEPT
> nft add rule ip filter INPUT tcp dport 80  ether saddr 0A:12:3E:4F:B2:C6 counter accept
                                           ^
                                      I have removed this space.

And mac address I have changed to show in lower-case.

So applied with minor glitches, thanks Shivani.