[PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option

[PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option

[rodanber]

From: Roberto García <rodanber@gmail.com>

Fix translation of MARK target's --set-xmark option.

Before:

 # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
  nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf

After:

  # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
  nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
  0xffffff50

Signed-off-by: Roberto García <rodanber@gmail.com>
---
 extensions/libxt_MARK.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
index ec1ed05..12ab94f 100644
--- a/extensions/libxt_MARK.c
+++ b/extensions/libxt_MARK.c
@@ -262,7 +262,7 @@ static int mark_tg_xlate(const void *ip, const struct xt_entry_target *target,
 		xt_xlate_add(xl, "0x%x ", info->mark);
 	else
 		xt_xlate_add(xl, "mark xor 0x%x and 0x%x ", info->mark,
-			     info->mask);
+			     ~info->mask);
 
 	return 1;
 }
-- 
2.8.0

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option

[Arturo Borrero Gonzalez]

On 21 June 2016 at 23:03,  <rodanber@gmail.com> wrote:
> From: Roberto García <rodanber@gmail.com>
>
> Fix translation of MARK target's --set-xmark option.
>
> Before:
>
>  # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>   nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
>
> After:
>
>   # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>   nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
>   0xffffff50
>
> Signed-off-by: Roberto García <rodanber@gmail.com>
> ---
>  extensions/libxt_MARK.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>

Seems good to me :-)

Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>

-- 
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option

[Florian Westphal]

rodanber@gmail.com <rodanber@gmail.com> wrote:
> From: Roberto García <rodanber@gmail.com>
> 
> Fix translation of MARK target's --set-xmark option.
> 
> Before:
> 
>  # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>   nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
> 
> After:
> 
>   # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>   nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
>   0xffffff50

Hmm, I wonder if this is correct...  iptables man page says:

 --set-xmark value[/mask]
   Zeroes out the bits given by mask and XORs value into the packet
   mark ("nfmark"). If mask is omitted, 0xFFFFFFFF is assumed.

So the iptables command is supposed to

   mark = skb->mark
   mark = mark & ~0xaf
   mark ^= 0x64
   skb->mark = mark

The proposed translation results in:
nft --debug=netlink add rule ip mangle PREROUTING meta mark set mark xor 0x64 and 0xffffff50
 [ meta load mark => reg 1 ]
 [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000040 ]
 [ meta set mark with reg 1 ]

 As you can see nft did perform the '0x64 and 0xffffff50' part in an
 optimization pass so we end up not masking anything and then xor'ing
 0x40.

I think this should be:
nft --debug=netlink add rule ip mangle PREROUTING meta mark set mark and 0xffffff50 xor 0x64
 [ meta load mark => reg 1 ]
 [ bitwise reg 1 = (reg=1 & 0xffffff50 ) ^ 0x00000064 ]
 [ meta set mark with reg 1 ]

which -- afaiu -- matches what the xtables target would do.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option

[Roberto García Calero]

I misunderstood the explanation of the option. I'm going to fix that 
right now.

Thanks for pointing out the error!

On 22/06/16 12:23, Florian Westphal wrote:
> rodanber@gmail.com <rodanber@gmail.com> wrote:
>> From: Roberto García <rodanber@gmail.com>
>>
>> Fix translation of MARK target's --set-xmark option.
>>
>> Before:
>>
>>  # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>>   nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
>>
>> After:
>>
>>   # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>>   nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
>>   0xffffff50
>
> Hmm, I wonder if this is correct...  iptables man page says:
>
>  --set-xmark value[/mask]
>    Zeroes out the bits given by mask and XORs value into the packet
>    mark ("nfmark"). If mask is omitted, 0xFFFFFFFF is assumed.
>
> So the iptables command is supposed to
>
>    mark = skb->mark
>    mark = mark & ~0xaf
>    mark ^= 0x64
>    skb->mark = mark
>
> The proposed translation results in:
> nft --debug=netlink add rule ip mangle PREROUTING meta mark set mark xor 0x64 and 0xffffff50
>  [ meta load mark => reg 1 ]
>  [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000040 ]
>  [ meta set mark with reg 1 ]
>
>  As you can see nft did perform the '0x64 and 0xffffff50' part in an
>  optimization pass so we end up not masking anything and then xor'ing
>  0x40.
>
> I think this should be:
> nft --debug=netlink add rule ip mangle PREROUTING meta mark set mark and 0xffffff50 xor 0x64
>  [ meta load mark => reg 1 ]
>  [ bitwise reg 1 = (reg=1 & 0xffffff50 ) ^ 0x00000064 ]
>  [ meta set mark with reg 1 ]
>
> which -- afaiu -- matches what the xtables target would do.
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option

[rodanber]

From: Roberto García <rodanber@gmail.com>

Fix translation of MARK target's --set-xmark option.

Before:
  #iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
  nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf

After:

  # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
  nft add rule ip mangle PREROUTING counter meta mark set mark and 0xffffff50 \
  xor 0x64

Signed-off-by: Roberto García <rodanber@gmail.com>
---
 extensions/libxt_MARK.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
index ec1ed05..bfcb030 100644
--- a/extensions/libxt_MARK.c
+++ b/extensions/libxt_MARK.c
@@ -261,8 +261,8 @@ static int mark_tg_xlate(const void *ip, const struct xt_entry_target *target,
 	else if (info->mask == 0xffffffffU)
 		xt_xlate_add(xl, "0x%x ", info->mark);
 	else
-		xt_xlate_add(xl, "mark xor 0x%x and 0x%x ", info->mark,
-			     info->mask);
+		xt_xlate_add(xl, "mark and 0x%x xor 0x%x ", ~info->mask,
+			     info->mark);
 
 	return 1;
 }
-- 
2.8.0

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option

[Pablo Neira Ayuso]

On Tue, Jun 21, 2016 at 11:03:43PM +0200, rodanber@gmail.com wrote:
> From: Roberto García <rodanber@gmail.com>
> 
> Fix translation of MARK target's --set-xmark option.
> 
> Before:
> 
>  # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>   nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
> 
> After:
> 
>   # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>   nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
>   0xffffff50

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html