comment: Add translation to nft
PATCH 1/1 comment: Add translation to nft
Add translation for match comment to nftables.
Example:
$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block" nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Signed-off-by Shivani Bhardwaj <[email protected]>
--- extensions/libxt_comment.c | 13 +++++++++++++ iptables/nft-ipv4.c | 17 +++++++++++++++-- 2 files changed, 28 insertions(+), 2 deletions(-)
extensions/libxt_comment.c +13 -0
@@ -48,6 +48,18 @@ comment_save(const void *ip, const struct xt_entry_match *match)xtables_save_string (commentinfo->comment); } +static int +comment_xlate (const struct xt_entry_match *match, +struct xt_buf *buf,int numeric) +{ +struct xt_comment_info *commentinfo = (void *)match->data; + + commentinfo->comment[XT_MAX_COMMENT_LEN -1 ] ='\0' ; +xt_buf_add (buf,"comment \\\"%s\\\" " , commentinfo->comment); + +return 1 ; +} +static struct xtables_match comment_match = { .family =NFPROTO_UNSPEC , .name ="comment" ,
@@ -59,6 +71,7 @@ static struct xtables_match comment_match = { .save = comment_save, .x6_parse = xtables_option_parse, .x6_options = comment_opts, + .xlate = comment_xlate, };void _init (void )
iptables/nft-ipv4.c +15 -2
@@ -433,6 +433,7 @@ static int nft_ipv4_xlate(const void *data, struct xt_buf *buf) {const struct iptables_command_state *cs = data;int ret; +bool comm = false;if (cs->fw.ip.iniface[0 ] !='\0' ) { xt_buf_add(buf, "iifname %s%s ",
@@ -477,12 +478,24 @@ static int nft_ipv4_xlate(const void *data, struct xt_buf *buf) inet_ntoa(cs->fw.ip.dst)); } +/* +* Add counter for match comment as prefix +*/ +if (strcmp (cs->matches->match->name,"comment" ) ==0 ) { + comm = true; +xt_buf_add (buf,"counter " ); + } + ret =xlate_matches (cs, buf);if (!ret)return ret; -/* Always add counters per rule, as in iptables */ -xt_buf_add (buf,"counter " ); +/* +* Always add counters per rule, as in iptables +* except for the match comment +*/ +if (!comm) +xt_buf_add (buf,"counter " ); ret =xlate_action (cs, !!(cs->fw.ip.flags &IPT_F_GOTO ), buf);
Signature · 1 line
1.9.1
Pablo Neira Ayuso
maintainerQuoted 6 lines · Shivani Bhardwaj
Add translation for match comment to nftables.
Example:
$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block" nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Could you rework this patch on top of these:
http://patchwork.ozlabs.org/patch/576671/
http://patchwork.ozlabs.org/patch/576673/
http://patchwork.ozlabs.org/patch/576672/
I have only compile-tested them.