* [PATCH] iptables: extensions: libxt_ecn: Add translation to nft
@ 2016-06-28 19:58 rodanber
2016-06-29 6:41 ` Arturo Borrero Gonzalez
2016-06-29 8:29 ` Arturo Borrero Gonzalez
0 siblings, 2 replies; 9+ messages in thread
From: rodanber @ 2016-06-28 19:58 UTC (permalink / raw)
To: arturo.borrero.glez, netfilter-devel; +Cc: pablo, Roberto García
From: Roberto García <rodanber@gmail.com>
Add translation of the ecn match to nftables.
Examples:
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
nft add rule ip filter INPUT ip ecn not-ect counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
nft add rule ip filter INPUT ip ecn ect1 counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
nft add rule ip filter INPUT ip ecn ect0 counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn ce counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
nft add rule ip filter INPUT ip ecn != not-ect counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
nft add rule ip filter INPUT ip ecn != ect1 counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
nft add rule ip filter INPUT ip ecn != ect0 counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn != ce counter
Signed-off-by: Roberto García <rodanber@gmail.com>
---
extensions/libxt_ecn.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
index 286782a..8e0c35b 100644
--- a/extensions/libxt_ecn.c
+++ b/extensions/libxt_ecn.c
@@ -118,6 +118,50 @@ static void ecn_save(const void *ip, const struct xt_entry_match *match)
}
}
+static int ecn_xlate(const void *ip, const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ const struct xt_ecn_info *einfo =
+ (const struct xt_ecn_info *)match->data;
+
+ if (einfo->operation & XT_ECN_OP_MATCH_IP) {
+ xt_xlate_add(xl, "ip ecn ");
+ if (einfo->invert) {
+ switch (einfo->ip_ect) {
+ case 0:
+ xt_xlate_add(xl, "!= not-ect ");
+ break;
+ case 1:
+ xt_xlate_add(xl, "!= ect1 ");
+ break;
+ case 2:
+ xt_xlate_add(xl, "!= ect0 ");
+ break;
+ case 3:
+ xt_xlate_add(xl, "!= ce ");
+ break;
+ }
+ } else {
+ switch (einfo->ip_ect) {
+ case 0:
+ xt_xlate_add(xl, "not-ect ");
+ break;
+ case 1:
+ xt_xlate_add(xl, "ect1 ");
+ break;
+ case 2:
+ xt_xlate_add(xl, "ect0 ");
+ break;
+ case 3:
+ xt_xlate_add(xl, "ce ");
+ break;
+ }
+ }
+ return 1;
+ } else
+ return 0;
+}
+
static struct xtables_match ecn_mt_reg = {
.name = "ecn",
.version = XTABLES_VERSION,
@@ -130,6 +174,7 @@ static struct xtables_match ecn_mt_reg = {
.x6_parse = ecn_parse,
.x6_fcheck = ecn_check,
.x6_options = ecn_opts,
+ .xlate = ecn_xlate,
};
void _init(void)
--
2.8.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH] iptables: extensions: libxt_ecn: Add translation to nft
2016-06-28 19:58 [PATCH] iptables: extensions: libxt_ecn: Add translation to nft rodanber
@ 2016-06-29 6:41 ` Arturo Borrero Gonzalez
2016-06-29 8:29 ` Arturo Borrero Gonzalez
1 sibling, 0 replies; 9+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-06-29 6:41 UTC (permalink / raw)
To: Roberto García; +Cc: Netfilter Development Mailing list, Pablo Neira Ayuso
On 28 June 2016 at 21:58, <rodanber@gmail.com> wrote:
> From: Roberto García <rodanber@gmail.com>
>
> Add translation of the ecn match to nftables.
>
> Examples:
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
> nft add rule ip filter INPUT ip ecn not-ect counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
> nft add rule ip filter INPUT ip ecn ect1 counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
> nft add rule ip filter INPUT ip ecn ect0 counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
> nft add rule ip filter INPUT ip ecn ce counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
> nft add rule ip filter INPUT ip ecn != not-ect counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
> nft add rule ip filter INPUT ip ecn != ect1 counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
> nft add rule ip filter INPUT ip ecn != ect0 counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
> nft add rule ip filter INPUT ip ecn != ce counter
>
> Signed-off-by: Roberto García <rodanber@gmail.com>
> ---
> extensions/libxt_ecn.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 45 insertions(+)
>
> diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
> index 286782a..8e0c35b 100644
> --- a/extensions/libxt_ecn.c
> +++ b/extensions/libxt_ecn.c
> @@ -118,6 +118,50 @@ static void ecn_save(const void *ip, const struct xt_entry_match *match)
> }
> }
>
> +static int ecn_xlate(const void *ip, const struct xt_entry_match *match,
> + struct xt_xlate *xl, int numeric)
> +{
> + const struct xt_ecn_info *einfo =
> + (const struct xt_ecn_info *)match->data;
> +
> + if (einfo->operation & XT_ECN_OP_MATCH_IP) {
> + xt_xlate_add(xl, "ip ecn ");
> + if (einfo->invert) {
> + switch (einfo->ip_ect) {
> + case 0:
> + xt_xlate_add(xl, "!= not-ect ");
> + break;
> + case 1:
> + xt_xlate_add(xl, "!= ect1 ");
> + break;
> + case 2:
> + xt_xlate_add(xl, "!= ect0 ");
> + break;
> + case 3:
> + xt_xlate_add(xl, "!= ce ");
> + break;
> + }
> + } else {
> + switch (einfo->ip_ect) {
> + case 0:
> + xt_xlate_add(xl, "not-ect ");
> + break;
> + case 1:
> + xt_xlate_add(xl, "ect1 ");
> + break;
> + case 2:
> + xt_xlate_add(xl, "ect0 ");
> + break;
> + case 3:
> + xt_xlate_add(xl, "ce ");
> + break;
I would try to compact a bit the code, ie:
[...]
xt_xlate_add(xl, "ip ecn ");
if (einfo->invert)
xt_xlate_add(xl, "!= ");
switch (einfo->ip_ect) {
case 0:
xt_xlate_add(xl, "not-ect");
break;
[...]
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] iptables: extensions: libxt_ecn: Add translation to nft
2016-06-28 19:58 [PATCH] iptables: extensions: libxt_ecn: Add translation to nft rodanber
2016-06-29 6:41 ` Arturo Borrero Gonzalez
@ 2016-06-29 8:29 ` Arturo Borrero Gonzalez
2016-06-29 8:50 ` Roberto García
1 sibling, 1 reply; 9+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-06-29 8:29 UTC (permalink / raw)
To: Roberto García; +Cc: Netfilter Development Mailing list, Pablo Neira Ayuso
On 28 June 2016 at 21:58, <rodanber@gmail.com> wrote:
> diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
> index 286782a..8e0c35b 100644
> --- a/extensions/libxt_ecn.c
> +++ b/extensions/libxt_ecn.c
> @@ -118,6 +118,50 @@ static void ecn_save(const void *ip, const struct xt_entry_match *match)
> }
> }
>
> +static int ecn_xlate(const void *ip, const struct xt_entry_match *match,
> + struct xt_xlate *xl, int numeric)
> +{
> + const struct xt_ecn_info *einfo =
> + (const struct xt_ecn_info *)match->data;
> +
> + if (einfo->operation & XT_ECN_OP_MATCH_IP) {
You could also do an early return here, given the case of this if ()
failing we have nothing to translate.
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] iptables: extensions: libxt_ecn: Add translation to nft
2016-06-29 8:29 ` Arturo Borrero Gonzalez
@ 2016-06-29 8:50 ` Roberto García
0 siblings, 0 replies; 9+ messages in thread
From: Roberto García @ 2016-06-29 8:50 UTC (permalink / raw)
To: Arturo Borrero Gonzalez
Cc: Netfilter Development Mailing list, Pablo Neira Ayuso
Ok, gonna fix that ASAP.
On 29/06/16 10:29, Arturo Borrero Gonzalez wrote:
> On 28 June 2016 at 21:58, <rodanber@gmail.com> wrote:
>> diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
>> index 286782a..8e0c35b 100644
>> --- a/extensions/libxt_ecn.c
>> +++ b/extensions/libxt_ecn.c
>> @@ -118,6 +118,50 @@ static void ecn_save(const void *ip, const struct xt_entry_match *match)
>> }
>> }
>>
>> +static int ecn_xlate(const void *ip, const struct xt_entry_match *match,
>> + struct xt_xlate *xl, int numeric)
>> +{
>> + const struct xt_ecn_info *einfo =
>> + (const struct xt_ecn_info *)match->data;
>> +
>> + if (einfo->operation & XT_ECN_OP_MATCH_IP) {
>
> You could also do an early return here, given the case of this if ()
> failing we have nothing to translate.
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH] iptables: extensions: libxt_ecn: Add translation to nft
@ 2016-06-29 9:24 rodanber
2016-06-29 9:28 ` Arturo Borrero Gonzalez
0 siblings, 1 reply; 9+ messages in thread
From: rodanber @ 2016-06-29 9:24 UTC (permalink / raw)
To: arturo.borrero.glez, netfilter-devel; +Cc: pablo, Roberto García
From: Roberto García <rodanber@gmail.com>
Add translation of the ecn match to nftables.
Examples:
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
nft add rule ip filter INPUT ip ecn not-ect counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
nft add rule ip filter INPUT ip ecn ect1 counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
nft add rule ip filter INPUT ip ecn ect0 counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn ce counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
nft add rule ip filter INPUT ip ecn != not-ect counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
nft add rule ip filter INPUT ip ecn != ect1 counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
nft add rule ip filter INPUT ip ecn != ect0 counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn != ce counter
Signed-off-by: Roberto García <rodanber@gmail.com>
---
extensions/libxt_ecn.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
index 286782a..4efdda3 100644
--- a/extensions/libxt_ecn.c
+++ b/extensions/libxt_ecn.c
@@ -118,6 +118,35 @@ static void ecn_save(const void *ip, const struct xt_entry_match *match)
}
}
+static int ecn_xlate(const void *ip, const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ const struct xt_ecn_info *einfo =
+ (const struct xt_ecn_info *)match->data;
+
+ if (einfo->operation & XT_ECN_OP_MATCH_IP) {
+ xt_xlate_add(xl, "ip ecn ");
+ if (einfo->invert)
+ xt_xlate_add(xl,"!= ");
+ switch (einfo->ip_ect) {
+ case 0:
+ xt_xlate_add(xl, "not-ect ");
+ break;
+ case 1:
+ xt_xlate_add(xl, "ect1 ");
+ break;
+ case 2:
+ xt_xlate_add(xl, "ect0 ");
+ break;
+ case 3:
+ xt_xlate_add(xl, "ce ");
+ break;
+ }
+ return 1;
+ } else
+ return 0;
+}
+
static struct xtables_match ecn_mt_reg = {
.name = "ecn",
.version = XTABLES_VERSION,
@@ -130,6 +159,7 @@ static struct xtables_match ecn_mt_reg = {
.x6_parse = ecn_parse,
.x6_fcheck = ecn_check,
.x6_options = ecn_opts,
+ .xlate = ecn_xlate,
};
void _init(void)
--
2.8.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH] iptables: extensions: libxt_ecn: Add translation to nft
2016-06-29 9:24 rodanber
@ 2016-06-29 9:28 ` Arturo Borrero Gonzalez
0 siblings, 0 replies; 9+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-06-29 9:28 UTC (permalink / raw)
To: Roberto García; +Cc: Netfilter Development Mailing list, Pablo Neira Ayuso
On 29 June 2016 at 11:24, <rodanber@gmail.com> wrote:
> From: Roberto García <rodanber@gmail.com>
>
> Add translation of the ecn match to nftables.
>
> Examples:
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
> nft add rule ip filter INPUT ip ecn not-ect counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
> nft add rule ip filter INPUT ip ecn ect1 counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
> nft add rule ip filter INPUT ip ecn ect0 counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
> nft add rule ip filter INPUT ip ecn ce counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
> nft add rule ip filter INPUT ip ecn != not-ect counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
> nft add rule ip filter INPUT ip ecn != ect1 counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
> nft add rule ip filter INPUT ip ecn != ect0 counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
> nft add rule ip filter INPUT ip ecn != ce counter
>
> Signed-off-by: Roberto García <rodanber@gmail.com>
> ---
> extensions/libxt_ecn.c | 30 ++++++++++++++++++++++++++++++
> 1 file changed, 30 insertions(+)
>
> diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
> index 286782a..4efdda3 100644
> --- a/extensions/libxt_ecn.c
> +++ b/extensions/libxt_ecn.c
> @@ -118,6 +118,35 @@ static void ecn_save(const void *ip, const struct xt_entry_match *match)
> }
> }
>
> +static int ecn_xlate(const void *ip, const struct xt_entry_match *match,
> + struct xt_xlate *xl, int numeric)
> +{
> + const struct xt_ecn_info *einfo =
> + (const struct xt_ecn_info *)match->data;
> +
> + if (einfo->operation & XT_ECN_OP_MATCH_IP) {
> + xt_xlate_add(xl, "ip ecn ");
> + if (einfo->invert)
> + xt_xlate_add(xl,"!= ");
> + switch (einfo->ip_ect) {
> + case 0:
> + xt_xlate_add(xl, "not-ect ");
> + break;
> + case 1:
> + xt_xlate_add(xl, "ect1 ");
> + break;
> + case 2:
> + xt_xlate_add(xl, "ect0 ");
> + break;
> + case 3:
> + xt_xlate_add(xl, "ce ");
> + break;
> + }
> + return 1;
> + } else
> + return 0;
> +}
Hi Roberto,
instead of wrapping all the translation composition inside the if(),
just return 0 if the condition is not met.
That's what I meant with the early return thing in my last email.
regards
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH] iptables: extensions: libxt_ecn: Add translation to nft
@ 2016-06-29 18:48 rodanber
2016-06-29 22:15 ` Roberto García
0 siblings, 1 reply; 9+ messages in thread
From: rodanber @ 2016-06-29 18:48 UTC (permalink / raw)
To: arturo.borrero.glez, netfilter-devel; +Cc: pablo, Roberto García
From: Roberto García <rodanber@gmail.com>
Add translation of the ecn match to nftables.
Examples:
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
nft add rule ip filter INPUT ip ecn not-ect counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
nft add rule ip filter INPUT ip ecn ect1 counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
nft add rule ip filter INPUT ip ecn ect0 counter
# iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn ce counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
nft add rule ip filter INPUT ip ecn != not-ect counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
nft add rule ip filter INPUT ip ecn != ect1 counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
nft add rule ip filter INPUT ip ecn != ect0 counter
# iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn != ce counter
Signed-off-by: Roberto García <rodanber@gmail.com>
---
extensions/libxt_ecn.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
index 286782a..2856a31 100644
--- a/extensions/libxt_ecn.c
+++ b/extensions/libxt_ecn.c
@@ -118,6 +118,36 @@ static void ecn_save(const void *ip, const struct xt_entry_match *match)
}
}
+static int ecn_xlate(const void *ip, const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ const struct xt_ecn_info *einfo =
+ (const struct xt_ecn_info *)match->data;
+
+ if (!(einfo->operation & XT_ECN_OP_MATCH_IP))
+ return 0;
+
+ xt_xlate_add(xl, "ip ecn ");
+ if (einfo->invert)
+ xt_xlate_add(xl,"!= ");
+
+ switch (einfo->ip_ect) {
+ case 0:
+ xt_xlate_add(xl, "not-ect ");
+ break;
+ case 1:
+ xt_xlate_add(xl, "ect1 ");
+ break;
+ case 2:
+ xt_xlate_add(xl, "ect0 ");
+ break;
+ case 3:
+ xt_xlate_add(xl, "ce ");
+ break;
+ }
+ return 1;
+}
+
static struct xtables_match ecn_mt_reg = {
.name = "ecn",
.version = XTABLES_VERSION,
@@ -130,6 +160,7 @@ static struct xtables_match ecn_mt_reg = {
.x6_parse = ecn_parse,
.x6_fcheck = ecn_check,
.x6_options = ecn_opts,
+ .xlate = ecn_xlate,
};
void _init(void)
--
2.8.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH] iptables: extensions: libxt_ecn: Add translation to nft
2016-06-29 18:48 rodanber
@ 2016-06-29 22:15 ` Roberto García
2016-07-01 14:17 ` Pablo Neira Ayuso
0 siblings, 1 reply; 9+ messages in thread
From: Roberto García @ 2016-06-29 22:15 UTC (permalink / raw)
To: Arturo Borrero Gonzalez, Netfilter Development Mailing list
Cc: Pablo Neira Ayuso, Roberto García
Reviewed-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
2016-06-29 20:48 GMT+02:00 <rodanber@gmail.com>:
>
> From: Roberto García <rodanber@gmail.com>
>
> Add translation of the ecn match to nftables.
>
> Examples:
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
> nft add rule ip filter INPUT ip ecn not-ect counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
> nft add rule ip filter INPUT ip ecn ect1 counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
> nft add rule ip filter INPUT ip ecn ect0 counter
>
> # iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
> nft add rule ip filter INPUT ip ecn ce counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
> nft add rule ip filter INPUT ip ecn != not-ect counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
> nft add rule ip filter INPUT ip ecn != ect1 counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
> nft add rule ip filter INPUT ip ecn != ect0 counter
>
> # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
> nft add rule ip filter INPUT ip ecn != ce counter
>
> Signed-off-by: Roberto García <rodanber@gmail.com>
> ---
> extensions/libxt_ecn.c | 31 +++++++++++++++++++++++++++++++
> 1 file changed, 31 insertions(+)
>
> diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
> index 286782a..2856a31 100644
> --- a/extensions/libxt_ecn.c
> +++ b/extensions/libxt_ecn.c
> @@ -118,6 +118,36 @@ static void ecn_save(const void *ip, const struct xt_entry_match *match)
> }
> }
>
> +static int ecn_xlate(const void *ip, const struct xt_entry_match *match,
> + struct xt_xlate *xl, int numeric)
> +{
> + const struct xt_ecn_info *einfo =
> + (const struct xt_ecn_info *)match->data;
> +
> + if (!(einfo->operation & XT_ECN_OP_MATCH_IP))
> + return 0;
> +
> + xt_xlate_add(xl, "ip ecn ");
> + if (einfo->invert)
> + xt_xlate_add(xl,"!= ");
> +
> + switch (einfo->ip_ect) {
> + case 0:
> + xt_xlate_add(xl, "not-ect ");
> + break;
> + case 1:
> + xt_xlate_add(xl, "ect1 ");
> + break;
> + case 2:
> + xt_xlate_add(xl, "ect0 ");
> + break;
> + case 3:
> + xt_xlate_add(xl, "ce ");
> + break;
> + }
> + return 1;
> +}
> +
> static struct xtables_match ecn_mt_reg = {
> .name = "ecn",
> .version = XTABLES_VERSION,
> @@ -130,6 +160,7 @@ static struct xtables_match ecn_mt_reg = {
> .x6_parse = ecn_parse,
> .x6_fcheck = ecn_check,
> .x6_options = ecn_opts,
> + .xlate = ecn_xlate,
> };
>
> void _init(void)
> --
> 2.8.0
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2016-07-01 14:18 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-06-28 19:58 [PATCH] iptables: extensions: libxt_ecn: Add translation to nft rodanber
2016-06-29 6:41 ` Arturo Borrero Gonzalez
2016-06-29 8:29 ` Arturo Borrero Gonzalez
2016-06-29 8:50 ` Roberto García
-- strict thread matches above, loose matches on Subject: below --
2016-06-29 9:24 rodanber
2016-06-29 9:28 ` Arturo Borrero Gonzalez
2016-06-29 18:48 rodanber
2016-06-29 22:15 ` Roberto García
2016-07-01 14:17 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).