Skip to contentSkip to conversation

extensions: libxt_mark: Fix inversion code

PATCH Superseded Shivani Bhardwaj 2 participants 2 messages Dec 22, 2015 – Dec 23, 2015 netfilter

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Shivani Bhardwaj

author
#0 lore raw

PATCH 1/1 extensions: libxt_mark: Fix inversion code

Fix the code associated with invert flag.

Examples:

$ sudo iptables-translate -I INPUT -p tcp -m mark ! --mark 0xa/0xa
nft insert rule ip filter INPUT ip protocol tcp mark and 0xa != 0xa counter
$ sudo iptables-translate -I INPUT -p tcp -m mark ! --mark 0x1
nft insert rule ip filter INPUT ip protocol tcp mark != 0x1 counter
Signed-off-by Shivani Bhardwaj <[email protected]>
---
 extensions/libxt_mark.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)
extensions/libxt_mark.c +18 -8
index 3b96a34..3beccc8 100644
@@ -1,5 +1,6 @@
 #include <stdbool.h>
 #include <stdio.h>
+#include <string.h>
 #include <xtables.h>
 #include <linux/netfilter/xt_mark.h>
 

@@ -103,13 +104,14 @@ mark_save(const void *ip, const struct xt_entry_match *match)
 }
 
 static void
-print_mark_xlate(struct xt_buf *buf,
-		 unsigned int mark, unsigned int mask)
+print_mark_xlate(struct xt_buf *buf, unsigned int mark,
+		 unsigned int mask, const char *str)
 {
 	if (mask != 0xffffffffU)
-		xt_buf_add(buf, " and 0x%x == 0x%x ", mark, mask);
+		xt_buf_add(buf, " and 0x%x %s 0x%x ", mark, str, mask);
 	else
-		xt_buf_add(buf, " 0x%x ", mark);
+		xt_buf_add(buf, " %s0x%x ",
+			   !strcmp(str, "==") ? "" : "!= ", mark);
 }
 
 static int

@@ -117,9 +119,13 @@ mark_mt_xlate(const struct xt_entry_match *match,
 	      struct xt_buf *buf, int numeric)
 {
 	const struct xt_mark_mtinfo1 *info = (const void *)match->data;
+	const char *str = "==";
 
-	xt_buf_add(buf, "mark%s", info->invert ? " !=" : "");
-	print_mark_xlate(buf, info->mark, info->mask);
+	if (info->invert)
+		str = "!=";
+
+	xt_buf_add(buf, "mark");
+	print_mark_xlate(buf, info->mark, info->mask, str);
 
 	return 1;
 }

@@ -129,9 +135,13 @@ mark_xlate(const struct xt_entry_match *match,
 	   struct xt_buf *buf, int numeric)
 {
 	const struct xt_mark_info *info = (const void *)match->data;
+	const char *str = "==";
+
+	if (info->invert)
+		str = "!=";
 
-	xt_buf_add(buf, "mark%s", info->invert ? " !=" : "");
-	print_mark_xlate(buf, info->mark, info->mask);
+	xt_buf_add(buf, "mark");
+	print_mark_xlate(buf, info->mark, info->mask, str);
 
 	return 1;
 }
Signature · 1 line
1.9.1
maintainer
#1 lore raw
Quoted 27 lines · Shivani Bhardwaj

Fix the code associated with invert flag.

Examples:

$ sudo iptables-translate -I INPUT -p tcp -m mark ! --mark 0xa/0xa
nft insert rule ip filter INPUT ip protocol tcp mark and 0xa != 0xa counter
$ sudo iptables-translate -I INPUT -p tcp -m mark ! --mark 0x1
nft insert rule ip filter INPUT ip protocol tcp mark != 0x1 counter
Signed-off-by Shivani Bhardwaj <[email protected]>
---
 extensions/libxt_mark.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)
extensions/libxt_mark.c +1 -0
index 3b96a34..3beccc8 100644
@@ -1,5 +1,6 @@
 #include <stdbool.h>
 #include <stdio.h>
+#include <string.h>
 #include <xtables.h>
 #include <linux/netfilter/xt_mark.h>

extensions/libxt_mark.c mark_save(const void *ip, const struct xt_entry_match *match) · line 104

Quoted 1 line
extensions/libxt_mark.c +0 -0
@@ -103,13 +104,14 @@ mark_save(const void *ip, const struct xt_entry_match *match)
 }

I suggest you add this to xtables.h:

enum {
        XT_OP_EQ,
        XT_OP_NEQ,
        XT_OP_MAX
};

extensions/libxt_mark.c mark_save(const void *ip, const struct xt_entry_match *match) · line 114

Quoted 13 lines
extensions/libxt_mark.c +5 -4
 static void
-print_mark_xlate(struct xt_buf *buf,
-		 unsigned int mark, unsigned int mask)
+print_mark_xlate(struct xt_buf *buf, unsigned int mark,
+		 unsigned int mask, const char *str)
 {
 	if (mask != 0xffffffffU)
-		xt_buf_add(buf, " and 0x%x == 0x%x ", mark, mask);
+		xt_buf_add(buf, " and 0x%x %s 0x%x ", mark, str, mask);
 	else
-		xt_buf_add(buf, " 0x%x ", mark);
+		xt_buf_add(buf, " %s0x%x ",
+			   !strcmp(str, "==") ? "" : "!= ", mark);

So instead of passing 'str' as parameter, you can pass a uint32_t op (enums are always guaranteed to be uint32_t).

Then

		xt_buf_add(buf, " %s0x%x ", op == XT_OP_EQ ? "" : "!=", mark);

extensions/libxt_mark.c mark_mt_xlate(const struct xt_entry_match *match, · line 122

Quoted 6 lines
extensions/libxt_mark.c +1 -0
 static int

@@ -117,9 +119,13 @@ mark_mt_xlate(const struct xt_entry_match *match,
 	      struct xt_buf *buf, int numeric)
 {
 	const struct xt_mark_mtinfo1 *info = (const void *)match->data;
+	const char *str = "==";

This code will be nicer using the approach I'm suggesting above.

Please, apply this suggestion to all your pending patches and resubmit.

Thanks Shivani.