| Message ID | 1466179850-20928-1-git-send-email-rodanber@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On 17 June 2016 at 18:10, <rodanber@gmail.com> wrote: > From: Roberto García <rodanber@gmail.com> > > Add translation for the CONNMARK target to nftables. > > The following options have no available translation: > > --save-mark [--nfmask nfmask] [--ctmask ctmask] > --restore-mark [--nfmask nfmask] [--ctmask ctmask] > > Examples: > > # iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0x16 > nft add rule ip mangle PREROUTING counter ct mark set 0x16 > > # iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-xmark 0x16/0x12 > nft add rule ip mangle PREROUTING counter ct mark set ct mark xor 0x16 and > 0xffffffed > > # iptables-translate -t mangle -A PREROUTING -j CONNMARK --and-mark 0x16 > nft add rule ip mangle PREROUTING counter ct mark set ct mark and 0x16 > > # iptables-translate -t mangle -A PREROUTING -j CONNMARK --or-mark 0x16 > nft add rule ip mangle PREROUTING counter ct mark set ct mark or 0x16 > > # iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark > nft add rule ip mangle PREROUTING counter ct mark set mark > > # iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark \ > --mask 0x12 > nft add rule ip mangle PREROUTING counter ct mark set mark and 0x12 > > # iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark > nft add rule ip mangle PREROUTING counter meta mark set ct mark > > # iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark \ > --mask 0x12 > nft add rule ip mangle PREROUTING counter meta mark set ct mark and 0x12 > > Signed-off-by: Roberto García <rodanber@gmail.com> > --- > extensions/libxt_CONNMARK.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 45 insertions(+) Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Applied with minor glitches. On Fri, Jun 17, 2016 at 06:10:50PM +0200, rodanber@gmail.com wrote: > +static int > +connmark_tg_xlate(const void *ip, const struct xt_entry_target *target, > + struct xt_xlate *xl, int numeric) > +{ > + const struct xt_connmark_tginfo1 *info = (const void *)target->data; > + ^^^^^ I can see there unnecessary indentation for an empty line. > + switch (info->mode) { > + case XT_CONNMARK_SET: > + xt_xlate_add(xl, "ct mark set "); > + if (info->ctmark == 0) > + xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask); > + else if (info->ctmark == info->ctmask) > + xt_xlate_add(xl, "ct mark or 0x%x", > + info->ctmark); > + else if (info->ctmask == 0) > + xt_xlate_add(xl, "ct mark xor 0x%x", > + info->ctmark); > + else if (info->ctmask == 0xFFFFFFFFU) > + xt_xlate_add(xl, "0x%x ", info->ctmark); > + else > + xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x", > + info->ctmark, ~info->ctmask); > + break; > + case XT_CONNMARK_SAVE: > + xt_xlate_add(xl, "ct mark set mark"); > + if (!(info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)) > + { Wrong coding style, instead: if (!(info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)) { ... I have fixed this here this time. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c index 42cf207..7940dcd 100644 --- a/extensions/libxt_CONNMARK.c +++ b/extensions/libxt_CONNMARK.c @@ -347,6 +347,50 @@ connmark_tg_save(const void *ip, const struct xt_entry_target *target) } } +static int +connmark_tg_xlate(const void *ip, const struct xt_entry_target *target, + struct xt_xlate *xl, int numeric) +{ + const struct xt_connmark_tginfo1 *info = (const void *)target->data; + + switch (info->mode) { + case XT_CONNMARK_SET: + xt_xlate_add(xl, "ct mark set "); + if (info->ctmark == 0) + xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask); + else if (info->ctmark == info->ctmask) + xt_xlate_add(xl, "ct mark or 0x%x", + info->ctmark); + else if (info->ctmask == 0) + xt_xlate_add(xl, "ct mark xor 0x%x", + info->ctmark); + else if (info->ctmask == 0xFFFFFFFFU) + xt_xlate_add(xl, "0x%x ", info->ctmark); + else + xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x", + info->ctmark, ~info->ctmask); + break; + case XT_CONNMARK_SAVE: + xt_xlate_add(xl, "ct mark set mark"); + if (!(info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)) + { + if (info->nfmask == info->ctmask) + xt_xlate_add(xl, " and 0x%x", info->nfmask); + } + break; + case XT_CONNMARK_RESTORE: + xt_xlate_add(xl, "meta mark set ct mark"); + if (!(info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)) + { + if (info->nfmask == info->ctmask) + xt_xlate_add(xl, " and 0x%x", info->nfmask); + } + break; + } + + return 1; +} + static struct xtables_target connmark_tg_reg[] = { { .family = NFPROTO_UNSPEC, @@ -377,6 +421,7 @@ static struct xtables_target connmark_tg_reg[] = { .x6_parse = connmark_tg_parse, .x6_fcheck = connmark_tg_check, .x6_options = connmark_tg_opts, + .xlate = connmark_tg_xlate, }, };