* [PATCH] comment: Add translation to nft
@ 2016-02-01 6:01 Shivani Bhardwaj
2016-02-01 18:44 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: Shivani Bhardwaj @ 2016-02-01 6:01 UTC (permalink / raw)
To: netfilter-devel
Add translation for match comment to nftables.
Example:
$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
| 13 +++++++++++++
iptables/nft-ipv4.c | 17 +++++++++++++++--
2 files changed, 28 insertions(+), 2 deletions(-)
--git a/extensions/libxt_comment.c b/extensions/libxt_comment.c
index 6ed2ff9..e80336c 100644
--- a/extensions/libxt_comment.c
+++ b/extensions/libxt_comment.c
@@ -48,6 +48,18 @@ comment_save(const void *ip, const struct xt_entry_match *match)
xtables_save_string(commentinfo->comment);
}
+static int
+comment_xlate(const struct xt_entry_match *match,
+ struct xt_buf *buf, int numeric)
+{
+ struct xt_comment_info *commentinfo = (void *)match->data;
+
+ commentinfo->comment[XT_MAX_COMMENT_LEN-1] = '\0';
+ xt_buf_add(buf, "comment \\\"%s\\\" ", commentinfo->comment);
+
+ return 1;
+}
+
static struct xtables_match comment_match = {
.family = NFPROTO_UNSPEC,
.name = "comment",
@@ -59,6 +71,7 @@ static struct xtables_match comment_match = {
.save = comment_save,
.x6_parse = xtables_option_parse,
.x6_options = comment_opts,
+ .xlate = comment_xlate,
};
void _init(void)
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index ede8f17..612b4f6 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -433,6 +433,7 @@ static int nft_ipv4_xlate(const void *data, struct xt_buf *buf)
{
const struct iptables_command_state *cs = data;
int ret;
+ bool comm = false;
if (cs->fw.ip.iniface[0] != '\0') {
xt_buf_add(buf, "iifname %s%s ",
@@ -477,12 +478,24 @@ static int nft_ipv4_xlate(const void *data, struct xt_buf *buf)
inet_ntoa(cs->fw.ip.dst));
}
+ /*
+ * Add counter for match comment as prefix
+ */
+ if (strcmp(cs->matches->match->name, "comment") == 0) {
+ comm = true;
+ xt_buf_add(buf, "counter ");
+ }
+
ret = xlate_matches(cs, buf);
if (!ret)
return ret;
- /* Always add counters per rule, as in iptables */
- xt_buf_add(buf, "counter ");
+ /*
+ * Always add counters per rule, as in iptables
+ * except for the match comment
+ */
+ if (!comm)
+ xt_buf_add(buf, "counter ");
ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), buf);
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] comment: Add translation to nft
2016-02-01 6:01 Shivani Bhardwaj
@ 2016-02-01 18:44 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2016-02-01 18:44 UTC (permalink / raw)
To: Shivani Bhardwaj; +Cc: netfilter-devel
On Mon, Feb 01, 2016 at 11:31:52AM +0530, Shivani Bhardwaj wrote:
> Add translation for match comment to nftables.
>
> Example:
>
> $ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
> nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Could you rework this patch on top of these:
http://patchwork.ozlabs.org/patch/576671/
http://patchwork.ozlabs.org/patch/576673/
http://patchwork.ozlabs.org/patch/576672/
I have only compile-tested them.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] comment: Add translation to nft
@ 2016-02-15 20:10 Shivani Bhardwaj
2016-02-16 11:18 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: Shivani Bhardwaj @ 2016-02-15 20:10 UTC (permalink / raw)
To: netfilter-devel
Add translation for match comment to nftables.
Example:
$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
| 14 ++++++++++++++
iptables/nft-ipv4.c | 17 +++++++++++++++--
iptables/nft-ipv6.c | 17 +++++++++++++++--
3 files changed, 44 insertions(+), 4 deletions(-)
--git a/extensions/libxt_comment.c b/extensions/libxt_comment.c
index 6ed2ff9..0461924 100644
--- a/extensions/libxt_comment.c
+++ b/extensions/libxt_comment.c
@@ -48,6 +48,19 @@ comment_save(const void *ip, const struct xt_entry_match *match)
xtables_save_string(commentinfo->comment);
}
+static int
+comment_xlate(const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ struct xt_comment_info *commentinfo = (void *)match->data;
+
+ commentinfo->comment[XT_MAX_COMMENT_LEN-1] = '\0';
+ xt_xlate_add_comment(xl, commentinfo->comment);
+ xt_xlate_add(xl, "comment \\\"%s\\\" ", commentinfo->comment);
+
+ return 1;
+}
+
static struct xtables_match comment_match = {
.family = NFPROTO_UNSPEC,
.name = "comment",
@@ -59,6 +72,7 @@ static struct xtables_match comment_match = {
.save = comment_save,
.x6_parse = xtables_option_parse,
.x6_options = comment_opts,
+ .xlate = comment_xlate,
};
void _init(void)
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 5e2857d..f816a8a 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -433,6 +433,7 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
{
const struct iptables_command_state *cs = data;
int ret;
+ bool comm = false;
if (cs->fw.ip.iniface[0] != '\0') {
xt_xlate_add(xl, "iifname %s%s ",
@@ -477,12 +478,24 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
inet_ntoa(cs->fw.ip.dst));
}
+ /*
+ * Add counter for match comment as prefix
+ */
+ if (strcmp(cs->matches->match->name, "comment") == 0) {
+ comm = true;
+ xt_xlate_add(xl, "counter ");
+ }
+
ret = xlate_matches(cs, xl);
if (!ret)
return ret;
- /* Always add counters per rule, as in iptables */
- xt_xlate_add(xl, "counter ");
+ /*
+ * Always add counters per rule, as in iptables
+ * except for match comment
+ */
+ if (!comm)
+ xt_xlate_add(xl, "counter ");
ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 0ee7957..edc572c 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -393,6 +393,7 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
{
const struct iptables_command_state *cs = data;
int ret;
+ bool comm = false;
if (cs->fw6.ipv6.iniface[0] != '\0') {
xt_xlate_add(xl, "iifname %s%s ",
@@ -428,12 +429,24 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
xlate_ipv6_addr("ip6 daddr", &cs->fw6.ipv6.dst,
cs->fw6.ipv6.invflags & IP6T_INV_DSTIP, xl);
+ /*
+ * Add counter as prefix for match comment
+ */
+ if (strcmp(cs->matches->match->name, "comment") == 0) {
+ comm = true;
+ xt_xlate_add(xl, "counter ");
+ }
+
ret = xlate_matches(cs, xl);
if (!ret)
return ret;
- /* Always add counters per rule, as in iptables */
- xt_xlate_add(xl, "counter ");
+ /*
+ * Always add counters per rule, as in iptables
+ * except for match comment
+ */
+ if (!comm)
+ xt_xlate_add(xl, "counter ");
ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl);
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] comment: Add translation to nft
2016-02-15 20:10 [PATCH] comment: Add translation to nft Shivani Bhardwaj
@ 2016-02-16 11:18 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2016-02-16 11:18 UTC (permalink / raw)
To: Shivani Bhardwaj; +Cc: netfilter-devel
On Tue, Feb 16, 2016 at 01:40:28AM +0530, Shivani Bhardwaj wrote:
> Add translation for match comment to nftables.
>
> Example:
>
> $ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
> nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
>
> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
> ---
> extensions/libxt_comment.c | 14 ++++++++++++++
> iptables/nft-ipv4.c | 17 +++++++++++++++--
> iptables/nft-ipv6.c | 17 +++++++++++++++--
> 3 files changed, 44 insertions(+), 4 deletions(-)
>
> diff --git a/extensions/libxt_comment.c b/extensions/libxt_comment.c
> index 6ed2ff9..0461924 100644
> --- a/extensions/libxt_comment.c
> +++ b/extensions/libxt_comment.c
> @@ -48,6 +48,19 @@ comment_save(const void *ip, const struct xt_entry_match *match)
> xtables_save_string(commentinfo->comment);
> }
>
> +static int
> +comment_xlate(const struct xt_entry_match *match,
> + struct xt_xlate *xl, int numeric)
> +{
> + struct xt_comment_info *commentinfo = (void *)match->data;
> +
> + commentinfo->comment[XT_MAX_COMMENT_LEN-1] = '\0';
> + xt_xlate_add_comment(xl, commentinfo->comment);
> + xt_xlate_add(xl, "comment \\\"%s\\\" ", commentinfo->comment);
You don't need this line above.
The idea after xt_xlate_add_comment() is that, from the core, you
print the comment in the right position.
See below.
> +
> + return 1;
> +}
> +
> static struct xtables_match comment_match = {
> .family = NFPROTO_UNSPEC,
> .name = "comment",
> @@ -59,6 +72,7 @@ static struct xtables_match comment_match = {
> .save = comment_save,
> .x6_parse = xtables_option_parse,
> .x6_options = comment_opts,
> + .xlate = comment_xlate,
> };
>
> void _init(void)
> diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
> index 5e2857d..f816a8a 100644
> --- a/iptables/nft-ipv4.c
> +++ b/iptables/nft-ipv4.c
> @@ -433,6 +433,7 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
> {
> const struct iptables_command_state *cs = data;
> int ret;
> + bool comm = false;
>
> if (cs->fw.ip.iniface[0] != '\0') {
> xt_xlate_add(xl, "iifname %s%s ",
> @@ -477,12 +478,24 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
> inet_ntoa(cs->fw.ip.dst));
> }
>
> + /*
> + * Add counter for match comment as prefix
> + */
> + if (strcmp(cs->matches->match->name, "comment") == 0) {
> + comm = true;
> + xt_xlate_add(xl, "counter ");
> + }
After my update you don't need to check if the match is comment
anymore, instead you can check if xl->comment is set, if so you print
the counter in first place to make sure it comes before the comment.
Please, send a v2. Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] comment: Add translation to nft
@ 2016-02-23 19:49 Shivani Bhardwaj
2016-02-29 12:34 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: Shivani Bhardwaj @ 2016-02-23 19:49 UTC (permalink / raw)
To: netfilter-devel
Add translation for match comment to nftables.
This patch also adds the relevant infrastructure for carrying out
the translation.
Example:
$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
| 13 +++++++++++++
include/xtables.h | 1 +
iptables/nft-ipv4.c | 6 ++++++
iptables/nft-ipv6.c | 6 ++++++
libxtables/xtables.c | 5 +++++
5 files changed, 31 insertions(+)
--git a/extensions/libxt_comment.c b/extensions/libxt_comment.c
index 6ed2ff9..464ca09 100644
--- a/extensions/libxt_comment.c
+++ b/extensions/libxt_comment.c
@@ -48,6 +48,18 @@ comment_save(const void *ip, const struct xt_entry_match *match)
xtables_save_string(commentinfo->comment);
}
+static int
+comment_xlate(const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ struct xt_comment_info *commentinfo = (void *)match->data;
+
+ commentinfo->comment[XT_MAX_COMMENT_LEN-1] = '\0';
+ xt_xlate_add_comment(xl, commentinfo->comment);
+
+ return 1;
+}
+
static struct xtables_match comment_match = {
.family = NFPROTO_UNSPEC,
.name = "comment",
@@ -59,6 +71,7 @@ static struct xtables_match comment_match = {
.save = comment_save,
.x6_parse = xtables_option_parse,
.x6_options = comment_opts,
+ .xlate = comment_xlate,
};
void _init(void)
diff --git a/include/xtables.h b/include/xtables.h
index 6fd3bdf..e219c9f 100644
--- a/include/xtables.h
+++ b/include/xtables.h
@@ -574,6 +574,7 @@ struct xt_xlate *xt_xlate_alloc(int size);
void xt_xlate_free(struct xt_xlate *xl);
void xt_xlate_add(struct xt_xlate *xl, const char *fmt, ...);
void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment);
+const char *xt_xlate_get_comment(struct xt_xlate *xl);
const char *xt_xlate_get(struct xt_xlate *xl);
#ifdef XTABLES_INTERNAL
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 5e2857d..3c41755 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -433,6 +433,7 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
{
const struct iptables_command_state *cs = data;
int ret;
+ const char *comment;
if (cs->fw.ip.iniface[0] != '\0') {
xt_xlate_add(xl, "iifname %s%s ",
@@ -484,6 +485,11 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
/* Always add counters per rule, as in iptables */
xt_xlate_add(xl, "counter ");
+ comment = xt_xlate_get_comment(xl);
+
+ if (strcmp(comment, ""))
+ xt_xlate_add(xl, "comment \\\"%s\\\" ", comment);
+
ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
return ret;
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index bbf289b..8912f1d 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -393,6 +393,7 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
{
const struct iptables_command_state *cs = data;
int ret;
+ const char *comment;
if (cs->fw6.ipv6.iniface[0] != '\0') {
xt_xlate_add(xl, "iifname %s%s ",
@@ -435,6 +436,11 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
/* Always add counters per rule, as in iptables */
xt_xlate_add(xl, "counter ");
+ comment = xt_xlate_get_comment(xl);
+
+ if (strcmp(comment, ""))
+ xt_xlate_add(xl, "comment \\\"%s\\\" ", comment);
+
ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl);
return ret;
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index c4b86f5..decd7be 100644
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -2045,6 +2045,11 @@ void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment)
xl->comment[NFT_USERDATA_MAXLEN - 1] = '\0';
}
+const char *xt_xlate_get_comment(struct xt_xlate *xl)
+{
+ return xl->comment;
+}
+
const char *xt_xlate_get(struct xt_xlate *xl)
{
return xl->buf.data;
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] comment: Add translation to nft
2016-02-23 19:49 Shivani Bhardwaj
@ 2016-02-29 12:34 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2016-02-29 12:34 UTC (permalink / raw)
To: Shivani Bhardwaj; +Cc: netfilter-devel
On Wed, Feb 24, 2016 at 01:19:34AM +0530, Shivani Bhardwaj wrote:
> Add translation for match comment to nftables.
> This patch also adds the relevant infrastructure for carrying out
> the translation.
>
> Example:
>
> $ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
> nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Applied with some changes, see final commit pushed upstream for updates.
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-02-29 12:35 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-15 20:10 [PATCH] comment: Add translation to nft Shivani Bhardwaj
2016-02-16 11:18 ` Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2016-02-23 19:49 Shivani Bhardwaj
2016-02-29 12:34 ` Pablo Neira Ayuso
2016-02-01 6:01 Shivani Bhardwaj
2016-02-01 18:44 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).