[PATCH iptables] extensions: libxt_connlabel: Add translation to nft

[PATCH iptables] extensions: libxt_connlabel: Add translation to nft

[Liping Zhang]

From: Liping Zhang <liping.zhang@spreadtrum.com>

Add translation for connlabel to nftables.
For examples:

  # iptables-translate -A INPUT -m connlabel --label bit40
  nft add rule ip filter INPUT ct label bit40 counter

  # iptables-translate -A INPUT -m connlabel ! --label bit40 --set
  nft add rule ip filter INPUT ct label set bit40 ct label != bit40 counter

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
 extensions/libxt_connlabel.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
index 1f83095..e9aeca8 100644
--- a/extensions/libxt_connlabel.c
+++ b/extensions/libxt_connlabel.c
@@ -118,6 +118,27 @@ connlabel_mt_save(const void *ip, const struct xt_entry_match *match)
 	connlabel_mt_print_op(info, "--");
 }
 
+static int
+connlabel_mt_xlate(const void *ip, const struct xt_entry_match *match,
+		   struct xt_xlate *xl, int numeric)
+{
+	const struct xt_connlabel_mtinfo *info = (const void *)match->data;
+	const char *name = connlabel_get_name(info->bit);
+
+	if (name == NULL)
+		return 0;
+
+	if (info->options & XT_CONNLABEL_OP_SET)
+		xt_xlate_add(xl, "ct label set %s ", name);
+
+	xt_xlate_add(xl, "ct label ");
+	if (info->options & XT_CONNLABEL_OP_INVERT)
+		xt_xlate_add(xl, "!= ");
+	xt_xlate_add(xl, "%s", name);
+
+	return 1;
+}
+
 static struct xtables_match connlabel_mt_reg = {
 	.family        = NFPROTO_UNSPEC,
 	.name          = "connlabel",
@@ -129,6 +150,7 @@ static struct xtables_match connlabel_mt_reg = {
 	.save          = connlabel_mt_save,
 	.x6_parse      = connlabel_mt_parse,
 	.x6_options    = connlabel_mt_opts,
+	.xlate	       = connlabel_mt_xlate,
 };
 
 void _init(void)
-- 
2.5.5

Re: [PATCH iptables] extensions: libxt_connlabel: Add translation to nft

[Florian Westphal]

Liping Zhang <zlpnobody@163.com> wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> Add translation for connlabel to nftables.
> For examples:
> 
>   # iptables-translate -A INPUT -m connlabel --label bit40
>   nft add rule ip filter INPUT ct label bit40 counter
> 
>   # iptables-translate -A INPUT -m connlabel ! --label bit40 --set
>   nft add rule ip filter INPUT ct label set bit40 ct label != bit40 counter

Should probably be:

... ct label and bit40 != bit40 ...

!= bit40 will be true if bit40 and another bit is set.

Re: [PATCH iptables] extensions: libxt_connlabel: Add translation to nft

[Liping Zhang]

At 2016-07-16 17:04:39, "Florian Westphal" <fw@strlen.de> wrote:
>Liping Zhang <zlpnobody@163.com> wrote:
>> 
>>   # iptables-translate -A INPUT -m connlabel ! --label bit40 --set
>>   nft add rule ip filter INPUT ct label set bit40 ct label != bit40 counter
>
>Should probably be:
>
>... ct label and bit40 != bit40 ...
>
>!= bit40 will be true if bit40 and another bit is set.

Right, "ct label bit40" and "ct label != bit40" have the different semantics:

# nft add rule filter input ct label bit40 --debug=netlink
ip filter input 
  [ ct load label => reg 1 ]
  [ bitwise reg 1 = (reg=1 & 0x00000000 0x00000100 0x00000000 0x00000000 ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ]
  [ cmp neq reg 1 0x00000000 0x00000000 0x00000000 0x00000000 ]

# nft add rule filter input ct label != bit40 --debug=netlink
ip filter input 
  [ ct load label => reg 1 ]
  [ cmp neq reg 1 0x00000000 0x00000100 0x00000000 0x00000000 ]

Will send V2 later, Thanks.