diff mbox

comment: Add translation to nft

Message ID 20160223194934.GA19483@gmail.com
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Shivani Bhardwaj Feb. 23, 2016, 7:49 p.m. UTC 
Add translation for match comment to nftables.
This patch also adds the relevant infrastructure for carrying out
the translation.

Example:

$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libxt_comment.c | 13 +++++++++++++
 include/xtables.h          |  1 +
 iptables/nft-ipv4.c        |  6 ++++++
 iptables/nft-ipv6.c        |  6 ++++++
 libxtables/xtables.c       |  5 +++++
 5 files changed, 31 insertions(+)

Comments

Pablo Neira Ayuso Feb. 29, 2016, 12:34 p.m. UTC | #1 
On Wed, Feb 24, 2016 at 01:19:34AM +0530, Shivani Bhardwaj wrote:
> Add translation for match comment to nftables.
> This patch also adds the relevant infrastructure for carrying out
> the translation.
> 
> Example:
> 
> $ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
> nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"

Applied with some changes, see final commit pushed upstream for updates.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/extensions/libxt_comment.c b/extensions/libxt_comment.c
index 6ed2ff9..464ca09 100644
--- a/extensions/libxt_comment.c
+++ b/extensions/libxt_comment.c
@@ -48,6 +48,18 @@  comment_save(const void *ip, const struct xt_entry_match *match)
 	xtables_save_string(commentinfo->comment);
 }
 
+static int
+comment_xlate(const struct xt_entry_match *match,
+	      struct xt_xlate *xl, int numeric)
+{
+	struct xt_comment_info *commentinfo = (void *)match->data;
+
+	commentinfo->comment[XT_MAX_COMMENT_LEN-1] = '\0';
+        xt_xlate_add_comment(xl, commentinfo->comment);
+
+	return 1;
+}
+
 static struct xtables_match comment_match = {
 	.family		= NFPROTO_UNSPEC,
 	.name		= "comment",
@@ -59,6 +71,7 @@  static struct xtables_match comment_match = {
 	.save 		= comment_save,
 	.x6_parse	= xtables_option_parse,
 	.x6_options	= comment_opts,
+	.xlate		= comment_xlate,
 };
 
 void _init(void)
diff --git a/include/xtables.h b/include/xtables.h
index 6fd3bdf..e219c9f 100644
--- a/include/xtables.h
+++ b/include/xtables.h
@@ -574,6 +574,7 @@  struct xt_xlate *xt_xlate_alloc(int size);
 void xt_xlate_free(struct xt_xlate *xl);
 void xt_xlate_add(struct xt_xlate *xl, const char *fmt, ...);
 void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment);
+const char *xt_xlate_get_comment(struct xt_xlate *xl);
 const char *xt_xlate_get(struct xt_xlate *xl);
 
 #ifdef XTABLES_INTERNAL
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 5e2857d..3c41755 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -433,6 +433,7 @@  static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
 {
 	const struct iptables_command_state *cs = data;
 	int ret;
+	const char *comment;
 
 	if (cs->fw.ip.iniface[0] != '\0') {
 		xt_xlate_add(xl, "iifname %s%s ",
@@ -484,6 +485,11 @@  static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
 	/* Always add counters per rule, as in iptables */
 	xt_xlate_add(xl, "counter ");
 
+	comment = xt_xlate_get_comment(xl);
+
+	if (strcmp(comment, ""))
+		xt_xlate_add(xl, "comment \\\"%s\\\" ", comment);
+
 	ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
 
 	return ret;
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index bbf289b..8912f1d 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -393,6 +393,7 @@  static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
 {
 	const struct iptables_command_state *cs = data;
 	int ret;
+	const char *comment;
 
 	if (cs->fw6.ipv6.iniface[0] != '\0') {
 		xt_xlate_add(xl, "iifname %s%s ",
@@ -435,6 +436,11 @@  static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
 	/* Always add counters per rule, as in iptables */
 	xt_xlate_add(xl, "counter ");
 
+	comment = xt_xlate_get_comment(xl);
+
+	if (strcmp(comment, ""))
+		xt_xlate_add(xl, "comment \\\"%s\\\" ", comment);
+
 	ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl);
 
 	return ret;
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index c4b86f5..decd7be 100644
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -2045,6 +2045,11 @@  void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment)
 	xl->comment[NFT_USERDATA_MAXLEN - 1] = '\0';
 }
 
+const char *xt_xlate_get_comment(struct xt_xlate *xl)
+{
+	return xl->comment;
+}
+
 const char *xt_xlate_get(struct xt_xlate *xl)
 {
 	return xl->buf.data;