[PATCH] extensions: libxt_connlabel: Add translation to nft

[PATCH] extensions: libxt_connlabel: Add translation to nft

[Shivani Bhardwaj]

Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.

Examples:

$ sudo iptables-translate -A INPUT -m connlabel --label eth0-in
nft add rule ip filter INPUT ct label eth0-in counter

$ sudo iptables-translate -A INPUT -m connlabel ! --label eth0-out
nft add rule ip filter INPUT ct label != eth0-out counter

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libxt_connlabel.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
index 1f83095..c3a96a6 100644
--- a/extensions/libxt_connlabel.c
+++ b/extensions/libxt_connlabel.c
@@ -118,6 +118,28 @@ connlabel_mt_save(const void *ip, const struct xt_entry_match *match)
 	connlabel_mt_print_op(info, "--");
 }
 
+static int
+connlabel_mt_xlate(const struct xt_entry_match *match,
+		   struct xt_xlate *xl, int numeric)
+{
+	const struct xt_connlabel_mtinfo *info = (const void *)match->data;
+	const char *name = connlabel_get_name(info->bit);
+
+	if (name)
+		xt_xlate_add(xl, "ct label %s%s ",
+			     info->options & XT_CONNLABEL_OP_INVERT ? "!= " : "",
+			     name);
+	else
+		xt_xlate_add(xl, "ct label %s%u ",
+			     info->options & XT_CONNLABEL_OP_INVERT ? "!= " : "",
+			     info->bit);
+
+	if (info->options & XT_CONNLABEL_OP_SET)
+		return 0;
+
+	return 1;
+}
+
 static struct xtables_match connlabel_mt_reg = {
 	.family        = NFPROTO_UNSPEC,
 	.name          = "connlabel",
@@ -129,6 +151,7 @@ static struct xtables_match connlabel_mt_reg = {
 	.save          = connlabel_mt_save,
 	.x6_parse      = connlabel_mt_parse,
 	.x6_options    = connlabel_mt_opts,
+	.xlate	       = connlabel_mt_xlate,
 };
 
 void _init(void)
-- 
1.9.1

Re: [PATCH] extensions: libxt_connlabel: Add translation to nft

[Florian Westphal]

Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> Add translation for connlabel to nftables.
> Full translation for this match awaits the support for --set option.

Hmm, I sent patches for that a while ago, don't know why they were
not applied... Pablo?

> Examples:
> 
> $ sudo iptables-translate -A INPUT -m connlabel --label eth0-in
> nft add rule ip filter INPUT ct label eth0-in counter

Looks good, thanks!

> $ sudo iptables-translate -A INPUT -m connlabel ! --label eth0-out
> nft add rule ip filter INPUT ct label != eth0-out counter

This one however is not correct.
It will match when eth0-out is not set, yes, but it will also match
if eth0-out and something else is also set.

(!= generates

[ cmp neq reg 1 0x00000004 0x00000000 0x00000000 0x00000000 ]

This should do the same thing as the -m connlabel ! --label ... command:

nft add rule ip filter INPUT ct label & eth0-in != eth0-in counter

[ ct load label => reg 1 ]
[ bitwise reg 1 = (reg=1 & 0x00000004 0x00000000 0x00000000 0x00000000 ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ]
[ cmp neq reg 1 0x00000004 0x00000000 0x00000000 0x00000000 ]

... so we load labels, then mask out everything except eth0-in, then
we check that this bit was not set.

Re: [PATCH] extensions: libxt_connlabel: Add translation to nft

[Pablo Neira Ayuso]

On Sun, Mar 06, 2016 at 01:07:03AM +0100, Florian Westphal wrote:
> Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> > Add translation for connlabel to nftables.
> > Full translation for this match awaits the support for --set option.
> 
> Hmm, I sent patches for that a while ago, don't know why they were
> not applied... Pablo?

Please, push the the connlabel support to nft.

We can probably introduce something like:

        ct connlabel bitset bar

instead of:

        ct connlabel set ct connlabel | bar

in a follow up patch, which looks more compact to me. We can accept
both syntax I'd say so we can introduce this without breaking
backward.

Re: [PATCH] extensions: libxt_connlabel: Add translation to nft

[Shivani Bhardwaj]

On Mon, Mar 7, 2016 at 6:35 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Sun, Mar 06, 2016 at 01:07:03AM +0100, Florian Westphal wrote:
>> Shivani Bhardwaj <shivanib134@gmail.com> wrote:
>> > Add translation for connlabel to nftables.
>> > Full translation for this match awaits the support for --set option.
>>
>> Hmm, I sent patches for that a while ago, don't know why they were
>> not applied... Pablo?
>
> Please, push the the connlabel support to nft.
>
> We can probably introduce something like:
>
>         ct connlabel bitset bar
>
> instead of:
>
>         ct connlabel set ct connlabel | bar
>
> in a follow up patch, which looks more compact to me. We can accept
> both syntax I'd say so we can introduce this without breaking
> backward.

Should I be waiting for this or send a v2 with the existing options?
Please let me know.
Thanks.

Re: [PATCH] extensions: libxt_connlabel: Add translation to nft

[Florian Westphal]

Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> On Mon, Mar 7, 2016 at 6:35 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Sun, Mar 06, 2016 at 01:07:03AM +0100, Florian Westphal wrote:
> >> Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> >> > Add translation for connlabel to nftables.
> >> > Full translation for this match awaits the support for --set option.
> >>
> >> Hmm, I sent patches for that a while ago, don't know why they were
> >> not applied... Pablo?
> >
> > Please, push the the connlabel support to nft.
> >
> > We can probably introduce something like:
> >
> >         ct connlabel bitset bar
> >
> > instead of:
> >
> >         ct connlabel set ct connlabel | bar
> >
> > in a follow up patch, which looks more compact to me. We can accept
> > both syntax I'd say so we can introduce this without breaking
> > backward.
> 
> Should I be waiting for this or send a v2 with the existing options?
> Please let me know.

I'd suggest you just send a v2, lets handle translation of --set in
a followup change later.

I'm currently not at home but I plan to push set support this week.

Re: [PATCH] extensions: libxt_connlabel: Add translation to nft

[Pablo Neira Ayuso]

On Mon, Mar 07, 2016 at 02:30:04PM +0100, Florian Westphal wrote:
> Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> > On Mon, Mar 7, 2016 at 6:35 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > On Sun, Mar 06, 2016 at 01:07:03AM +0100, Florian Westphal wrote:
> > >> Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> > >> > Add translation for connlabel to nftables.
> > >> > Full translation for this match awaits the support for --set option.
> > >>
> > >> Hmm, I sent patches for that a while ago, don't know why they were
> > >> not applied... Pablo?
> > >
> > > Please, push the the connlabel support to nft.
> > >
> > > We can probably introduce something like:
> > >
> > >         ct connlabel bitset bar
> > >
> > > instead of:
> > >
> > >         ct connlabel set ct connlabel | bar
> > >
> > > in a follow up patch, which looks more compact to me. We can accept
> > > both syntax I'd say so we can introduce this without breaking
> > > backward.
> > 
> > Should I be waiting for this or send a v2 with the existing options?
> > Please let me know.
> 
> I'd suggest you just send a v2, lets handle translation of --set in
> a followup change later.
>
> I'm currently not at home but I plan to push set support this week.

OK; then please wait to send a v2 Shivani.

Re: [PATCH] extensions: libxt_connlabel: Add translation to nft

[Pablo Neira Ayuso]

On Mon, Mar 07, 2016 at 06:55:31PM +0530, Shivani Bhardwaj wrote:
> On Mon, Mar 7, 2016 at 6:35 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Sun, Mar 06, 2016 at 01:07:03AM +0100, Florian Westphal wrote:
> >> Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> >> > Add translation for connlabel to nftables.
> >> > Full translation for this match awaits the support for --set option.
> >>
> >> Hmm, I sent patches for that a while ago, don't know why they were
> >> not applied... Pablo?
> >
> > Please, push the the connlabel support to nft.
> >
> > We can probably introduce something like:
> >
> >         ct connlabel bitset bar
> >
> > instead of:
> >
> >         ct connlabel set ct connlabel | bar
> >
> > in a follow up patch, which looks more compact to me. We can accept
> > both syntax I'd say so we can introduce this without breaking
> > backward.
> 
> Should I be waiting for this or send a v2 with the existing options?

The current translation seems fine (unless Florian indicates
otherwise). We can incrementally improve this.

Re: [PATCH] extensions: libxt_connlabel: Add translation to nft

[Shivani Bhardwaj]

On Mon, Mar 7, 2016 at 7:02 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Mon, Mar 07, 2016 at 06:55:31PM +0530, Shivani Bhardwaj wrote:
>> On Mon, Mar 7, 2016 at 6:35 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>> > On Sun, Mar 06, 2016 at 01:07:03AM +0100, Florian Westphal wrote:
>> >> Shivani Bhardwaj <shivanib134@gmail.com> wrote:
>> >> > Add translation for connlabel to nftables.
>> >> > Full translation for this match awaits the support for --set option.
>> >>
>> >> Hmm, I sent patches for that a while ago, don't know why they were
>> >> not applied... Pablo?
>> >
>> > Please, push the the connlabel support to nft.
>> >
>> > We can probably introduce something like:
>> >
>> >         ct connlabel bitset bar
>> >
>> > instead of:
>> >
>> >         ct connlabel set ct connlabel | bar
>> >
>> > in a follow up patch, which looks more compact to me. We can accept
>> > both syntax I'd say so we can introduce this without breaking
>> > backward.
>>
>> Should I be waiting for this or send a v2 with the existing options?
>
> The current translation seems fine (unless Florian indicates
> otherwise). We can incrementally improve this.

Yes, Florian pointed that the translation corresponding to inversion
is incorrect. So, I already need to fix that.