* [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option
@ 2016-06-21 21:03 rodanber
2016-06-22 9:49 ` Arturo Borrero Gonzalez
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: rodanber @ 2016-06-21 21:03 UTC (permalink / raw)
To: arturo.borrero.glez; +Cc: pablo, netfilter-devel, Roberto García
From: Roberto García <rodanber@gmail.com>
Fix translation of MARK target's --set-xmark option.
Before:
# iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
After:
# iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
0xffffff50
Signed-off-by: Roberto García <rodanber@gmail.com>
---
extensions/libxt_MARK.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
index ec1ed05..12ab94f 100644
--- a/extensions/libxt_MARK.c
+++ b/extensions/libxt_MARK.c
@@ -262,7 +262,7 @@ static int mark_tg_xlate(const void *ip, const struct xt_entry_target *target,
xt_xlate_add(xl, "0x%x ", info->mark);
else
xt_xlate_add(xl, "mark xor 0x%x and 0x%x ", info->mark,
- info->mask);
+ ~info->mask);
return 1;
}
--
2.8.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option
2016-06-21 21:03 [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option rodanber
@ 2016-06-22 9:49 ` Arturo Borrero Gonzalez
2016-06-22 10:23 ` Florian Westphal
2016-06-22 17:55 ` Pablo Neira Ayuso
2 siblings, 0 replies; 6+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-06-22 9:49 UTC (permalink / raw)
To: Roberto García; +Cc: Pablo Neira Ayuso, Netfilter Development Mailing list
On 21 June 2016 at 23:03, <rodanber@gmail.com> wrote:
> From: Roberto García <rodanber@gmail.com>
>
> Fix translation of MARK target's --set-xmark option.
>
> Before:
>
> # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
> nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
>
> After:
>
> # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
> nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
> 0xffffff50
>
> Signed-off-by: Roberto García <rodanber@gmail.com>
> ---
> extensions/libxt_MARK.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
Seems good to me :-)
Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option
2016-06-21 21:03 [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option rodanber
2016-06-22 9:49 ` Arturo Borrero Gonzalez
@ 2016-06-22 10:23 ` Florian Westphal
2016-06-22 11:34 ` Roberto García Calero
2016-06-22 17:55 ` Pablo Neira Ayuso
2 siblings, 1 reply; 6+ messages in thread
From: Florian Westphal @ 2016-06-22 10:23 UTC (permalink / raw)
To: rodanber; +Cc: arturo.borrero.glez, pablo, netfilter-devel
rodanber@gmail.com <rodanber@gmail.com> wrote:
> From: Roberto García <rodanber@gmail.com>
>
> Fix translation of MARK target's --set-xmark option.
>
> Before:
>
> # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
> nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
>
> After:
>
> # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
> nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
> 0xffffff50
Hmm, I wonder if this is correct... iptables man page says:
--set-xmark value[/mask]
Zeroes out the bits given by mask and XORs value into the packet
mark ("nfmark"). If mask is omitted, 0xFFFFFFFF is assumed.
So the iptables command is supposed to
mark = skb->mark
mark = mark & ~0xaf
mark ^= 0x64
skb->mark = mark
The proposed translation results in:
nft --debug=netlink add rule ip mangle PREROUTING meta mark set mark xor 0x64 and 0xffffff50
[ meta load mark => reg 1 ]
[ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000040 ]
[ meta set mark with reg 1 ]
As you can see nft did perform the '0x64 and 0xffffff50' part in an
optimization pass so we end up not masking anything and then xor'ing
0x40.
I think this should be:
nft --debug=netlink add rule ip mangle PREROUTING meta mark set mark and 0xffffff50 xor 0x64
[ meta load mark => reg 1 ]
[ bitwise reg 1 = (reg=1 & 0xffffff50 ) ^ 0x00000064 ]
[ meta set mark with reg 1 ]
which -- afaiu -- matches what the xtables target would do.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option
2016-06-22 10:23 ` Florian Westphal
@ 2016-06-22 11:34 ` Roberto García Calero
0 siblings, 0 replies; 6+ messages in thread
From: Roberto García Calero @ 2016-06-22 11:34 UTC (permalink / raw)
To: Florian Westphal; +Cc: arturo.borrero.glez, pablo, netfilter-devel
I misunderstood the explanation of the option. I'm going to fix that
right now.
Thanks for pointing out the error!
On 22/06/16 12:23, Florian Westphal wrote:
> rodanber@gmail.com <rodanber@gmail.com> wrote:
>> From: Roberto García <rodanber@gmail.com>
>>
>> Fix translation of MARK target's --set-xmark option.
>>
>> Before:
>>
>> # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>> nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
>>
>> After:
>>
>> # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
>> nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
>> 0xffffff50
>
> Hmm, I wonder if this is correct... iptables man page says:
>
> --set-xmark value[/mask]
> Zeroes out the bits given by mask and XORs value into the packet
> mark ("nfmark"). If mask is omitted, 0xFFFFFFFF is assumed.
>
> So the iptables command is supposed to
>
> mark = skb->mark
> mark = mark & ~0xaf
> mark ^= 0x64
> skb->mark = mark
>
> The proposed translation results in:
> nft --debug=netlink add rule ip mangle PREROUTING meta mark set mark xor 0x64 and 0xffffff50
> [ meta load mark => reg 1 ]
> [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000040 ]
> [ meta set mark with reg 1 ]
>
> As you can see nft did perform the '0x64 and 0xffffff50' part in an
> optimization pass so we end up not masking anything and then xor'ing
> 0x40.
>
> I think this should be:
> nft --debug=netlink add rule ip mangle PREROUTING meta mark set mark and 0xffffff50 xor 0x64
> [ meta load mark => reg 1 ]
> [ bitwise reg 1 = (reg=1 & 0xffffff50 ) ^ 0x00000064 ]
> [ meta set mark with reg 1 ]
>
> which -- afaiu -- matches what the xtables target would do.
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option
2016-06-21 21:03 [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option rodanber
2016-06-22 9:49 ` Arturo Borrero Gonzalez
2016-06-22 10:23 ` Florian Westphal
@ 2016-06-22 17:55 ` Pablo Neira Ayuso
2 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2016-06-22 17:55 UTC (permalink / raw)
To: rodanber; +Cc: arturo.borrero.glez, netfilter-devel
On Tue, Jun 21, 2016 at 11:03:43PM +0200, rodanber@gmail.com wrote:
> From: Roberto García <rodanber@gmail.com>
>
> Fix translation of MARK target's --set-xmark option.
>
> Before:
>
> # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
> nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
>
> After:
>
> # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
> nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and \
> 0xffffff50
Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option
@ 2016-06-22 12:31 rodanber
0 siblings, 0 replies; 6+ messages in thread
From: rodanber @ 2016-06-22 12:31 UTC (permalink / raw)
To: arturo.borrero.glez; +Cc: pablo, netfilter-devel, fw, Roberto García
From: Roberto García <rodanber@gmail.com>
Fix translation of MARK target's --set-xmark option.
Before:
#iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf
After:
# iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf
nft add rule ip mangle PREROUTING counter meta mark set mark and 0xffffff50 \
xor 0x64
Signed-off-by: Roberto García <rodanber@gmail.com>
---
extensions/libxt_MARK.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
index ec1ed05..bfcb030 100644
--- a/extensions/libxt_MARK.c
+++ b/extensions/libxt_MARK.c
@@ -261,8 +261,8 @@ static int mark_tg_xlate(const void *ip, const struct xt_entry_target *target,
else if (info->mask == 0xffffffffU)
xt_xlate_add(xl, "0x%x ", info->mark);
else
- xt_xlate_add(xl, "mark xor 0x%x and 0x%x ", info->mark,
- info->mask);
+ xt_xlate_add(xl, "mark and 0x%x xor 0x%x ", ~info->mask,
+ info->mark);
return 1;
}
--
2.8.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-06-22 17:55 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-06-21 21:03 [PATCH] iptables: extensions: libxt_MARK: Fix translation of --set-xmark option rodanber
2016-06-22 9:49 ` Arturo Borrero Gonzalez
2016-06-22 10:23 ` Florian Westphal
2016-06-22 11:34 ` Roberto García Calero
2016-06-22 17:55 ` Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2016-06-22 12:31 rodanber
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).