Re: [PATCH xtables] extensions: xt_TPROXY: add txlate support

[Phil Sutter <phil@nwl.cc>]

On Thu, Mar 07, 2024 at 03:05:28PM +0100, Florian Westphal wrote:
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  extensions/libxt_TPROXY.c      | 59 ++++++++++++++++++++++++++++++++++
>  extensions/libxt_TPROXY.txlate | 17 ++++++++++
>  2 files changed, 76 insertions(+)
>  create mode 100644 extensions/libxt_TPROXY.txlate
> 
> diff --git a/extensions/libxt_TPROXY.c b/extensions/libxt_TPROXY.c
> index d13ec85f92d0..4d2d7961ca2c 100644
> --- a/extensions/libxt_TPROXY.c
> +++ b/extensions/libxt_TPROXY.c
> @@ -147,6 +147,62 @@ static void tproxy_tg1_parse(struct xt_option_call *cb)
>  	}
>  }
>  
> +static int tproxy_tg_xlate(struct xt_xlate *xl,
> +			   const struct xt_tproxy_target_info_v1 *info)
> +{
> +	int family = xt_xlate_get_family(xl);
> +	uint32_t mask = info->mark_mask;
> +	bool port_mandatory = false;
> +	char buf[INET6_ADDRSTRLEN];
> +
> +	xt_xlate_add(xl, "tproxy to");
> +
> +	inet_ntop(family, &info->laddr, buf, sizeof(buf));
> +
> +	if (family == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(&info->laddr.in6))
> +		xt_xlate_add(xl, "[%s]", buf);

Could you please add a testcase involving an IPv6 address? Just so we
exercise this code path.

> +	else if (family == AF_INET && info->laddr.ip)
> +		xt_xlate_add(xl, "%s", buf);
> +	else
> +		port_mandatory = true;
> +
> +	if (port_mandatory)
> +		xt_xlate_add(xl, " :%d", ntohs(info->lport));
> +	else if (info->lport)
> +		xt_xlate_add(xl, ":%d", ntohs(info->lport));
> +
> +	/* xt_TPROXY.c does: skb->mark = (skb->mark & ~mark_mask) ^ mark_value */
> +	if (mask == 0xffffffff)
> +		xt_xlate_add(xl, "meta mark set 0x%x", info->mark_value);
> +	else if (mask || info->mark_value)
> +		xt_xlate_add(xl, "meta mark set meta mark & 0x%x or 0x%x",
> +			     ~mask, info->mark_value);

Shouldn't this be 'xor' instead of 'or' in translated output? I wanted
to suggest "meta mark set meta mark and not <mask> xor <mark_value>",
but it seems nft supports only boolean negations.

Thanks, Phil