extensions: libxt_NFQUEUE: Add translation to nft

PATCH Superseded Shivani Bhardwaj 2 participants 5 messages Feb 7, 2016 – Feb 9, 2016 netfilter

lore

Share & tools

lore

Shivani Bhardwaj

author

2016-02-07 06:07 UTC #0 lore raw

PATCH v2 1/1 extensions: libxt_NFQUEUE: Add translation to nft

Add translation for NF queue to nftables.

Examples:

$ sudo iptables-translate -t nat -A PREROUTING -p tcp --dport 80 -j NFQUEUE --queue-num 30
nft add rule ip nat PREROUTING tcp dport 80 counter queue num 30

$ sudo iptables-translate -A FORWARD -j NFQUEUE --queue-num 0 --queue-bypass -p TCP --sport 80
nft add rule ip filter FORWARD tcp sport 80 counter queue num 0 bypass

$ sudo iptables-translate -A FORWARD -j NFQUEUE --queue-bypass -p TCP --sport 80 --queue-balance 0:3 --queue-cpu-fanout
nft add rule ip filter FORWARD tcp sport 80 counter queue num 0-3 bypass,fanout

Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v2:
Fix the code for queue-balance

 extensions/libxt_NFQUEUE.c | 62 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 61 insertions(+), 1 deletion(-)

extensions/libxt_NFQUEUE.c +61 -1

index 0c86918..ea38f86 100644
@@ -205,6 +205,62 @@ static void NFQUEUE_init_v1(struct xt_entry_target *t)
 	tinfo->queues_total = 1;
 }
 
+static int NFQUEUE_xlate(const struct xt_entry_target *target,
+			 struct xt_xlate *xl, int numeric)
+{
+	const struct xt_NFQ_info *tinfo =
+		(const struct xt_NFQ_info *)target->data;
+
+	xt_xlate_add(xl, "queue num %u ", tinfo->queuenum);
+
+	return 1;
+}
+
+static int NFQUEUE_xlate_v1(const struct xt_entry_target *target,
+			    struct xt_xlate *xl, int numeric)
+{
+	const struct xt_NFQ_info_v1 *tinfo = (const void *)target->data;
+	unsigned int last = tinfo->queues_total;
+
+	if (last > 1) {
+		last += tinfo->queuenum - 1;
+		xt_xlate_add(xl, "queue num %u-%u ", tinfo->queuenum, last);
+	} else {
+		xt_xlate_add(xl, "queue num %u ", tinfo->queuenum);
+	}
+
+	return 1;
+}
+
+bool sep_need = false;
+
+static int NFQUEUE_xlate_v2(const struct xt_entry_target *target,
+			    struct xt_xlate *xl, int numeric)
+{
+	const struct xt_NFQ_info_v2 *info = (void *) target->data;
+
+	NFQUEUE_xlate_v1(target, xl, numeric);
+
+	if (info->bypass & NFQ_FLAG_BYPASS) {
+		xt_xlate_add(xl, "bypass");
+		sep_need = true;
+	}
+
+	return 1;
+}
+
+static int NFQUEUE_xlate_v3(const struct xt_entry_target *target,
+			    struct xt_xlate *xl, int numeric)
+{
+	const struct xt_NFQ_info_v3 *info = (void *)target->data;
+
+	NFQUEUE_xlate_v2(target, xl, numeric);
+	if (info->flags & NFQ_FLAG_CPU_FANOUT)
+		xt_xlate_add(xl, "%sfanout ", sep_need ? "," : "");
+
+	return 1;
+}
+
 static struct xtables_target nfqueue_targets[] = {
 {
 	.family		= NFPROTO_UNSPEC,

@@ -216,7 +272,8 @@ static struct xtables_target nfqueue_targets[] = {
 	.print		= NFQUEUE_print,
 	.save		= NFQUEUE_save,
 	.x6_parse	= NFQUEUE_parse,
-	.x6_options	= NFQUEUE_opts
+	.x6_options	= NFQUEUE_opts,
+	.xlate		= NFQUEUE_xlate,
 },{
 	.family		= NFPROTO_UNSPEC,
 	.revision	= 1,

@@ -230,6 +287,7 @@ static struct xtables_target nfqueue_targets[] = {
 	.save		= NFQUEUE_save_v1,
 	.x6_parse	= NFQUEUE_parse_v1,
 	.x6_options	= NFQUEUE_opts,
+	.xlate		= NFQUEUE_xlate_v1,
 },{
 	.family		= NFPROTO_UNSPEC,
 	.revision	= 2,

@@ -243,6 +301,7 @@ static struct xtables_target nfqueue_targets[] = {
 	.save		= NFQUEUE_save_v2,
 	.x6_parse	= NFQUEUE_parse_v2,
 	.x6_options	= NFQUEUE_opts,
+	.xlate		= NFQUEUE_xlate_v2,
 },{
 	.family		= NFPROTO_UNSPEC,
 	.revision	= 3,

@@ -256,6 +315,7 @@ static struct xtables_target nfqueue_targets[] = {
 	.save		= NFQUEUE_save_v3,
 	.x6_parse	= NFQUEUE_parse_v3,
 	.x6_options	= NFQUEUE_opts,
+	.xlate		= NFQUEUE_xlate_v3,
 }
 };

Signature · 1 line

1.9.1

Florian Westphal

maintainer

2016-02-07 09:25 UTC #1 lore raw

Quoted 8 lines · Shivani Bhardwaj

$ sudo iptables-translate -t nat -A PREROUTING -p tcp --dport 80 -j NFQUEUE --queue-num 30
nft add rule ip nat PREROUTING tcp dport 80 counter queue num 30

$ sudo iptables-translate -A FORWARD -j NFQUEUE --queue-num 0 --queue-bypass -p TCP --sport 80
nft add rule ip filter FORWARD tcp sport 80 counter queue num 0 bypass

$ sudo iptables-translate -A FORWARD -j NFQUEUE --queue-bypass -p TCP --sport 80 --queue-balance 0:3 --queue-cpu-fanout
nft add rule ip filter FORWARD tcp sport 80 counter queue num 0-3 bypass,fanout

translation look correct, thanks!

Quoted 1 line

+bool sep_need = false;

Is this really needed?
If it is, please add static keyword too.

Quoted 14 lines

extensions/libxt_NFQUEUE.c +14 -0

+static int NFQUEUE_xlate_v2(const struct xt_entry_target *target,
+			    struct xt_xlate *xl, int numeric)
+{
+	const struct xt_NFQ_info_v2 *info = (void *) target->data;
+
+	NFQUEUE_xlate_v1(target, xl, numeric);
+
+	if (info->bypass & NFQ_FLAG_BYPASS) {
+		xt_xlate_add(xl, "bypass");
+		sep_need = true;
+	}
+
+	return 1;
+}

extensions/libxt_NFQUEUE.c static void NFQUEUE_init_v1(struct xt_entry_target *t) · line 260

Quoted 10 lines

extensions/libxt_NFQUEUE.c +10 -0

+
+static int NFQUEUE_xlate_v3(const struct xt_entry_target *target,
+			    struct xt_xlate *xl, int numeric)
+{
+	const struct xt_NFQ_info_v3 *info = (void *)target->data;
+
+	NFQUEUE_xlate_v2(target, xl, numeric);
+	if (info->flags & NFQ_FLAG_CPU_FANOUT)
+		xt_xlate_add(xl, "%sfanout ", sep_need ? "," : "");
+

Seems this could be written similar to something like:

if (info->flags & NFQ_FLAG_CPU_FANOUT) {
	bool sep_needed = info->bypass & NFQ_FLAG_BYPASS;
	xt_xlate_add(xl, "%sfanout ", sep_need ? "," : "");

...

Shivani Bhardwaj

author

2016-02-07 15:12 UTC #2 lore raw

Quoted 10 lines · Florian Westphal

Quoted 8 lines · Shivani Bhardwaj

$ sudo iptables-translate -t nat -A PREROUTING -p tcp --dport 80 -j NFQUEUE --queue-num 30
nft add rule ip nat PREROUTING tcp dport 80 counter queue num 30

$ sudo iptables-translate -A FORWARD -j NFQUEUE --queue-num 0 --queue-bypass -p TCP --sport 80
nft add rule ip filter FORWARD tcp sport 80 counter queue num 0 bypass

$ sudo iptables-translate -A FORWARD -j NFQUEUE --queue-bypass -p TCP --sport 80 --queue-balance 0:3 --queue-cpu-fanout
nft add rule ip filter FORWARD tcp sport 80 counter queue num 0-3 bypass,fanout

Quoted 7 lines

translation look correct, thanks!
Quoted 1 line
+bool sep_need = false;
Is this really needed?
If it is, please add static keyword too.

Done. Please check the new version of this patch.

Quoted 27 lines

Quoted 14 lines

extensions/libxt_NFQUEUE.c +14 -0

+static int NFQUEUE_xlate_v2(const struct xt_entry_target *target,
+                         struct xt_xlate *xl, int numeric)
+{
+     const struct xt_NFQ_info_v2 *info = (void *) target->data;
+
+     NFQUEUE_xlate_v1(target, xl, numeric);
+
+     if (info->bypass & NFQ_FLAG_BYPASS) {
+             xt_xlate_add(xl, "bypass");
+             sep_need = true;
+     }
+
+     return 1;
+}

extensions/libxt_NFQUEUE.c static void NFQUEUE_init_v1(struct xt_entry_target *t) · line 260

Quoted 10 lines

extensions/libxt_NFQUEUE.c +10 -0

+
+static int NFQUEUE_xlate_v3(const struct xt_entry_target *target,
+                         struct xt_xlate *xl, int numeric)
+{
+     const struct xt_NFQ_info_v3 *info = (void *)target->data;
+
+     NFQUEUE_xlate_v2(target, xl, numeric);
+     if (info->flags & NFQ_FLAG_CPU_FANOUT)
+             xt_xlate_add(xl, "%sfanout ", sep_need ? "," : "");
+

Seems this could be written similar to something like:

Quoted 4 lines

if (info->flags & NFQ_FLAG_CPU_FANOUT) {
        bool sep_needed = info->bypass & NFQ_FLAG_BYPASS;
        xt_xlate_add(xl, "%sfanout ", sep_need ? "," : "");

...

The pointer info used in both the versions (of NFQUEUE_xlate) is for different structures. Sadly, this doesn't work as v3 structure doesn't have a member for bypass field.

Thanks a lot.

Florian Westphal

maintainer

2016-02-08 09:29 UTC #3 lore raw

Quoted 4 lines · Shivani Bhardwaj

Quoted 2 lines · Florian Westphal
Seems this could be written similar to something like:

Quoted 8 lines

Quoted 4 lines
if (info->flags & NFQ_FLAG_CPU_FANOUT) {
        bool sep_needed = info->bypass & NFQ_FLAG_BYPASS;
        xt_xlate_add(xl, "%sfanout ", sep_need ? "," : "");
...
The pointer info used in both the versions (of NFQUEUE_xlate) is for different structures. Sadly, this doesn't work as v3 structure doesn't have a member for bypass field.

Oh, right. However bypass & flags overlap -- I think you could just use info->flags & NFQ_FLAG_BYPASS.

If you look at NFQUEUE_parse_v3() it just calls NFQUEUE_parse_v2() with the v3 structure.

Shivani Bhardwaj

author

2016-02-09 08:52 UTC #4 lore raw

Quoted 14 lines · Florian Westphal

Quoted 4 lines · Shivani Bhardwaj
Quoted 2 lines · Florian Westphal
Seems this could be written similar to something like:
Quoted 8 lines
Quoted 4 lines
if (info->flags & NFQ_FLAG_CPU_FANOUT) {
        bool sep_needed = info->bypass & NFQ_FLAG_BYPASS;
        xt_xlate_add(xl, "%sfanout ", sep_need ? "," : "");
...
The pointer info used in both the versions (of NFQUEUE_xlate) is for different structures. Sadly, this doesn't work as v3 structure doesn't have a member for bypass field.

Quoted 5 lines

Oh, right. However bypass & flags overlap -- I think you could just use info->flags & NFQ_FLAG_BYPASS.
If you look at NFQUEUE_parse_v3() it just calls NFQUEUE_parse_v2() with the v3 structure.

Yes, the code looks better now. Thanks a lot, Florian.