* [PATCH] iptables: extensions: libxt_CONNMARK: Add translation to nft
@ 2016-06-17 16:10 rodanber
2016-06-18 11:34 ` Arturo Borrero Gonzalez
2016-06-22 17:54 ` Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: rodanber @ 2016-06-17 16:10 UTC (permalink / raw)
To: arturo.borrero.glez; +Cc: pablo, netfilter-devel, Roberto García
From: Roberto García <rodanber@gmail.com>
Add translation for the CONNMARK target to nftables.
The following options have no available translation:
--save-mark [--nfmask nfmask] [--ctmask ctmask]
--restore-mark [--nfmask nfmask] [--ctmask ctmask]
Examples:
# iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0x16
nft add rule ip mangle PREROUTING counter ct mark set 0x16
# iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-xmark 0x16/0x12
nft add rule ip mangle PREROUTING counter ct mark set ct mark xor 0x16 and
0xffffffed
# iptables-translate -t mangle -A PREROUTING -j CONNMARK --and-mark 0x16
nft add rule ip mangle PREROUTING counter ct mark set ct mark and 0x16
# iptables-translate -t mangle -A PREROUTING -j CONNMARK --or-mark 0x16
nft add rule ip mangle PREROUTING counter ct mark set ct mark or 0x16
# iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark
nft add rule ip mangle PREROUTING counter ct mark set mark
# iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark \
--mask 0x12
nft add rule ip mangle PREROUTING counter ct mark set mark and 0x12
# iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark
nft add rule ip mangle PREROUTING counter meta mark set ct mark
# iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark \
--mask 0x12
nft add rule ip mangle PREROUTING counter meta mark set ct mark and 0x12
Signed-off-by: Roberto García <rodanber@gmail.com>
---
extensions/libxt_CONNMARK.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
index 42cf207..7940dcd 100644
--- a/extensions/libxt_CONNMARK.c
+++ b/extensions/libxt_CONNMARK.c
@@ -347,6 +347,50 @@ connmark_tg_save(const void *ip, const struct xt_entry_target *target)
}
}
+static int
+connmark_tg_xlate(const void *ip, const struct xt_entry_target *target,
+ struct xt_xlate *xl, int numeric)
+{
+ const struct xt_connmark_tginfo1 *info = (const void *)target->data;
+
+ switch (info->mode) {
+ case XT_CONNMARK_SET:
+ xt_xlate_add(xl, "ct mark set ");
+ if (info->ctmark == 0)
+ xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask);
+ else if (info->ctmark == info->ctmask)
+ xt_xlate_add(xl, "ct mark or 0x%x",
+ info->ctmark);
+ else if (info->ctmask == 0)
+ xt_xlate_add(xl, "ct mark xor 0x%x",
+ info->ctmark);
+ else if (info->ctmask == 0xFFFFFFFFU)
+ xt_xlate_add(xl, "0x%x ", info->ctmark);
+ else
+ xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x",
+ info->ctmark, ~info->ctmask);
+ break;
+ case XT_CONNMARK_SAVE:
+ xt_xlate_add(xl, "ct mark set mark");
+ if (!(info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX))
+ {
+ if (info->nfmask == info->ctmask)
+ xt_xlate_add(xl, " and 0x%x", info->nfmask);
+ }
+ break;
+ case XT_CONNMARK_RESTORE:
+ xt_xlate_add(xl, "meta mark set ct mark");
+ if (!(info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX))
+ {
+ if (info->nfmask == info->ctmask)
+ xt_xlate_add(xl, " and 0x%x", info->nfmask);
+ }
+ break;
+ }
+
+ return 1;
+}
+
static struct xtables_target connmark_tg_reg[] = {
{
.family = NFPROTO_UNSPEC,
@@ -377,6 +421,7 @@ static struct xtables_target connmark_tg_reg[] = {
.x6_parse = connmark_tg_parse,
.x6_fcheck = connmark_tg_check,
.x6_options = connmark_tg_opts,
+ .xlate = connmark_tg_xlate,
},
};
--
2.8.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] iptables: extensions: libxt_CONNMARK: Add translation to nft
2016-06-17 16:10 [PATCH] iptables: extensions: libxt_CONNMARK: Add translation to nft rodanber
@ 2016-06-18 11:34 ` Arturo Borrero Gonzalez
2016-06-22 17:54 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-06-18 11:34 UTC (permalink / raw)
To: Roberto García; +Cc: Pablo Neira Ayuso, Netfilter Development Mailing list
On 17 June 2016 at 18:10, <rodanber@gmail.com> wrote:
> From: Roberto García <rodanber@gmail.com>
>
> Add translation for the CONNMARK target to nftables.
>
> The following options have no available translation:
>
> --save-mark [--nfmask nfmask] [--ctmask ctmask]
> --restore-mark [--nfmask nfmask] [--ctmask ctmask]
>
> Examples:
>
> # iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0x16
> nft add rule ip mangle PREROUTING counter ct mark set 0x16
>
> # iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-xmark 0x16/0x12
> nft add rule ip mangle PREROUTING counter ct mark set ct mark xor 0x16 and
> 0xffffffed
>
> # iptables-translate -t mangle -A PREROUTING -j CONNMARK --and-mark 0x16
> nft add rule ip mangle PREROUTING counter ct mark set ct mark and 0x16
>
> # iptables-translate -t mangle -A PREROUTING -j CONNMARK --or-mark 0x16
> nft add rule ip mangle PREROUTING counter ct mark set ct mark or 0x16
>
> # iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark
> nft add rule ip mangle PREROUTING counter ct mark set mark
>
> # iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark \
> --mask 0x12
> nft add rule ip mangle PREROUTING counter ct mark set mark and 0x12
>
> # iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark
> nft add rule ip mangle PREROUTING counter meta mark set ct mark
>
> # iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark \
> --mask 0x12
> nft add rule ip mangle PREROUTING counter meta mark set ct mark and 0x12
>
> Signed-off-by: Roberto García <rodanber@gmail.com>
> ---
> extensions/libxt_CONNMARK.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 45 insertions(+)
Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] iptables: extensions: libxt_CONNMARK: Add translation to nft
2016-06-17 16:10 [PATCH] iptables: extensions: libxt_CONNMARK: Add translation to nft rodanber
2016-06-18 11:34 ` Arturo Borrero Gonzalez
@ 2016-06-22 17:54 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2016-06-22 17:54 UTC (permalink / raw)
To: rodanber; +Cc: arturo.borrero.glez, netfilter-devel
Applied with minor glitches.
On Fri, Jun 17, 2016 at 06:10:50PM +0200, rodanber@gmail.com wrote:
> +static int
> +connmark_tg_xlate(const void *ip, const struct xt_entry_target *target,
> + struct xt_xlate *xl, int numeric)
> +{
> + const struct xt_connmark_tginfo1 *info = (const void *)target->data;
> +
^^^^^
I can see there unnecessary indentation for an empty line.
> + switch (info->mode) {
> + case XT_CONNMARK_SET:
> + xt_xlate_add(xl, "ct mark set ");
> + if (info->ctmark == 0)
> + xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask);
> + else if (info->ctmark == info->ctmask)
> + xt_xlate_add(xl, "ct mark or 0x%x",
> + info->ctmark);
> + else if (info->ctmask == 0)
> + xt_xlate_add(xl, "ct mark xor 0x%x",
> + info->ctmark);
> + else if (info->ctmask == 0xFFFFFFFFU)
> + xt_xlate_add(xl, "0x%x ", info->ctmark);
> + else
> + xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x",
> + info->ctmark, ~info->ctmask);
> + break;
> + case XT_CONNMARK_SAVE:
> + xt_xlate_add(xl, "ct mark set mark");
> + if (!(info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX))
> + {
Wrong coding style, instead:
if (!(info->nfmask == UINT32_MAX &&
info->ctmask == UINT32_MAX)) {
...
I have fixed this here this time. Thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-06-22 17:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-06-17 16:10 [PATCH] iptables: extensions: libxt_CONNMARK: Add translation to nft rodanber
2016-06-18 11:34 ` Arturo Borrero Gonzalez
2016-06-22 17:54 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).