| Message ID | 1465044150-13229-1-git-send-email-rodanber@gmail.com |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
On 4 June 2016 at 14:42, <rodanber@gmail.com> wrote: > From: Roberto García <rodanber@gmail.com> > > Add translation for the MARK target to nftables. > > Examples: > > $ sudo iptables-translate -t mangle -A OUTPUT -p tcp --dport 22 -j MARK > --set-mark 64 > nft add rule ip mangle OUTPUT tcp dport 22 counter meta mark set 0x40 > > $ sudo iptables-translate -t mangle -A OUTPUT -p tcp --dport 22 -j MARK > --set-xmark 64 > nft add rule ip mangle OUTPUT tcp dport 22 counter meta mark set 0x40 > > $ sudo iptables-translate -t mangle -A OUTPUT -p tcp --dport 22 -j MARK > --or-mark 64 > nft add rule ip mangle OUTPUT tcp dport 22 counter meta mark set mark or 0x40 > > $ sudo iptables-translate -t mangle -A OUTPUT -p tcp --dport 22 -j MARK --and-mark > 64 > nft add rule ip mangle OUTPUT tcp dport 22 counter meta mark set mark and 0x40 > > $ sudo iptables-translate -t mangle -A OUTPUT -p tcp --dport 22 -j MARK > --xor-mark 64 > > nft add rule ip mangle OUTPUT tcp dport 22 counter meta mark set mark xor 0x40 > I miss some examples on working with masks. I would like to see how do you translate for example '--set-xmark value/mask' and '--set-mark value/mask'. Perhaps you could delete the '-p tcp --dport 22' thing, so we are short and to the point with the examples. > Signed-off-by: Roberto García <rodanber@gmail.com> > --- > extensions/libxt_MARK.c | 21 +++++++++++++++++++++ > 1 file changed, 21 insertions(+) > > diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c > index 556dbde..9383f64 100644 > --- a/extensions/libxt_MARK.c > +++ b/extensions/libxt_MARK.c > @@ -245,6 +245,26 @@ static void mark_tg_save(const void *ip, const struct xt_entry_target *target) > printf(" --set-xmark 0x%x/0x%x", info->mark, info->mask); > } > > +static int mark_tg_xlate(const void *ip, const struct xt_entry_target *target, > + struct xt_xlate *xl, int numeric) > +{ > + const struct xt_mark_tginfo2 *info = (const void *)target->data; > + > + if (info->mark == 0) > + xt_xlate_add(xl, "meta mark set mark and 0x%x", > + (unsigned int)(uint32_t)~info->mask); This double casting seems very weird to me. I would try to have only one casting at most. Did you try it? Probably no cast is even required, actually (I don't know) > + else if (info->mark == info->mask) > + xt_xlate_add(xl, "meta mark set mark or 0x%x", info->mark); > + else if (info->mask == 0) > + xt_xlate_add(xl, "meta mark set mark xor 0x%x", info->mark); > + else if (info->mask == 0xffffffffU) > + xt_xlate_add(xl, "meta mark set 0x%x", info->mark); > + else > + xt_xlate_add(xl, "meta mark xset 0x%x/0x%x", info->mark, info->mask); 'meta mark xset' ? Probably you can print 'meta mark set' unconditionally so you avoid this kind of errors. > + > + return 1; > +}
diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c index 556dbde..9383f64 100644 --- a/extensions/libxt_MARK.c +++ b/extensions/libxt_MARK.c @@ -245,6 +245,26 @@ static void mark_tg_save(const void *ip, const struct xt_entry_target *target) printf(" --set-xmark 0x%x/0x%x", info->mark, info->mask); } +static int mark_tg_xlate(const void *ip, const struct xt_entry_target *target, + struct xt_xlate *xl, int numeric) +{ + const struct xt_mark_tginfo2 *info = (const void *)target->data; + + if (info->mark == 0) + xt_xlate_add(xl, "meta mark set mark and 0x%x", + (unsigned int)(uint32_t)~info->mask); + else if (info->mark == info->mask) + xt_xlate_add(xl, "meta mark set mark or 0x%x", info->mark); + else if (info->mask == 0) + xt_xlate_add(xl, "meta mark set mark xor 0x%x", info->mark); + else if (info->mask == 0xffffffffU) + xt_xlate_add(xl, "meta mark set 0x%x", info->mark); + else + xt_xlate_add(xl, "meta mark xset 0x%x/0x%x", info->mark, info->mask); + + return 1; +} + static struct xtables_target mark_tg_reg[] = { { .family = NFPROTO_UNSPEC, @@ -287,6 +307,7 @@ static struct xtables_target mark_tg_reg[] = { .x6_parse = mark_tg_parse, .x6_fcheck = mark_tg_check, .x6_options = mark_tg_opts, + .xlate = mark_tg_xlate, }, };