Skip to contentSkip to conversation

comment: Add translation to nft

PATCH In review Shivani Bhardwaj 2 participants 2 messages Feb 15, 2016 – Feb 16, 2016 netfilter

lore
Share & tools
lore

Shivani Bhardwaj

author
#0 lore raw

PATCH 1/1 comment: Add translation to nft

Add translation for match comment to nftables.

Example:

$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Signed-off-by Shivani Bhardwaj <[email protected]>
---
 extensions/libxt_comment.c | 14 ++++++++++++++
 iptables/nft-ipv4.c        | 17 +++++++++++++++--
 iptables/nft-ipv6.c        | 17 +++++++++++++++--
 3 files changed, 44 insertions(+), 4 deletions(-)
extensions/libxt_comment.c +14 -0
index 6ed2ff9..0461924 100644
@@ -48,6 +48,19 @@ comment_save(const void *ip, const struct xt_entry_match *match)
 	xtables_save_string(commentinfo->comment);
 }
 
+static int
+comment_xlate(const struct xt_entry_match *match,
+	      struct xt_xlate *xl, int numeric)
+{
+	struct xt_comment_info *commentinfo = (void *)match->data;
+
+	commentinfo->comment[XT_MAX_COMMENT_LEN-1] = '\0';
+	xt_xlate_add_comment(xl, commentinfo->comment);
+	xt_xlate_add(xl, "comment \\\"%s\\\" ", commentinfo->comment);
+
+	return 1;
+}
+
 static struct xtables_match comment_match = {
 	.family		= NFPROTO_UNSPEC,
 	.name		= "comment",

@@ -59,6 +72,7 @@ static struct xtables_match comment_match = {
 	.save 		= comment_save,
 	.x6_parse	= xtables_option_parse,
 	.x6_options	= comment_opts,
+	.xlate		= comment_xlate,
 };
 
 void _init(void)
iptables/nft-ipv4.c +15 -2
index 5e2857d..f816a8a 100644
@@ -433,6 +433,7 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
 {
 	const struct iptables_command_state *cs = data;
 	int ret;
+	bool comm = false;
 
 	if (cs->fw.ip.iniface[0] != '\0') {
 		xt_xlate_add(xl, "iifname %s%s ",

@@ -477,12 +478,24 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
 			   inet_ntoa(cs->fw.ip.dst));
 	}
 
+	/*
+	 * Add counter for match comment as prefix
+	 */
+	if (strcmp(cs->matches->match->name, "comment") == 0) {
+		comm = true;
+		xt_xlate_add(xl, "counter ");
+	}
+
 	ret = xlate_matches(cs, xl);
 	if (!ret)
 		return ret;
 
-	/* Always add counters per rule, as in iptables */
-	xt_xlate_add(xl, "counter ");
+	/*
+	 * Always add counters per rule, as in iptables
+	 * except for match comment
+	 */
+	if (!comm)
+		xt_xlate_add(xl, "counter ");
 
 	ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
iptables/nft-ipv6.c +15 -2
index 0ee7957..edc572c 100644
@@ -393,6 +393,7 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
 {
 	const struct iptables_command_state *cs = data;
 	int ret;
+	bool comm = false;
 
 	if (cs->fw6.ipv6.iniface[0] != '\0') {
 		xt_xlate_add(xl, "iifname %s%s ",

@@ -428,12 +429,24 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
 	xlate_ipv6_addr("ip6 daddr", &cs->fw6.ipv6.dst,
 			cs->fw6.ipv6.invflags & IP6T_INV_DSTIP, xl);
 
+	/*
+	 * Add counter as prefix for match comment
+	 */
+	if (strcmp(cs->matches->match->name, "comment") == 0) {
+		comm = true;
+		xt_xlate_add(xl, "counter ");
+	}
+
 	ret = xlate_matches(cs, xl);
 	if (!ret)
 		return ret;
 
-	/* Always add counters per rule, as in iptables */
-	xt_xlate_add(xl, "counter ");
+	/*
+	 * Always add counters per rule, as in iptables
+	 * except for match comment
+	 */
+	if (!comm)
+		xt_xlate_add(xl, "counter ");
 
 	ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl);
Signature · 1 line
1.9.1
maintainer
#1 lore raw
Quoted 21 lines · Shivani Bhardwaj

Add translation for match comment to nftables.

Example:

$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"
Signed-off-by Shivani Bhardwaj <[email protected]>
---
 extensions/libxt_comment.c | 14 ++++++++++++++
 iptables/nft-ipv4.c        | 17 +++++++++++++++--
 iptables/nft-ipv6.c        | 17 +++++++++++++++--
 3 files changed, 44 insertions(+), 4 deletions(-)
extensions/libxt_comment.c +0 -0
index 6ed2ff9..0461924 100644
@@ -48,6 +48,19 @@ comment_save(const void *ip, const struct xt_entry_match *match)
 	xtables_save_string(commentinfo->comment);
 }

extensions/libxt_comment.c comment_save(const void *ip, const struct xt_entry_match *match) · line 59

Quoted 10 lines
extensions/libxt_comment.c +9 -0
 
+static int
+comment_xlate(const struct xt_entry_match *match,
+	      struct xt_xlate *xl, int numeric)
+{
+	struct xt_comment_info *commentinfo = (void *)match->data;
+
+	commentinfo->comment[XT_MAX_COMMENT_LEN-1] = '\0';
+	xt_xlate_add_comment(xl, commentinfo->comment);
+	xt_xlate_add(xl, "comment \\\"%s\\\" ", commentinfo->comment);

You don't need this line above.

The idea after xt_xlate_add_comment() is that, from the core, you print the comment in the right position.

See below.

Quoted 28 lines
extensions/libxt_comment.c +5 -0
+
+	return 1;
+}
+
 static struct xtables_match comment_match = {
 	.family		= NFPROTO_UNSPEC,
 	.name		= "comment",

@@ -59,6 +72,7 @@ static struct xtables_match comment_match = {
 	.save 		= comment_save,
 	.x6_parse	= xtables_option_parse,
 	.x6_options	= comment_opts,
+	.xlate		= comment_xlate,
 };
 
 void _init(void)
iptables/nft-ipv4.c +1 -0
index 5e2857d..f816a8a 100644
@@ -433,6 +433,7 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
 {
 	const struct iptables_command_state *cs = data;
 	int ret;
+	bool comm = false;
 
 	if (cs->fw.ip.iniface[0] != '\0') {
 		xt_xlate_add(xl, "iifname %s%s ",

iptables/nft-ipv4.c static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl) · line 487

Quoted 10 lines
iptables/nft-ipv4.c +7 -0
@@ -477,12 +478,24 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
 			   inet_ntoa(cs->fw.ip.dst));
 	}
 
+	/*
+	 * Add counter for match comment as prefix
+	 */
+	if (strcmp(cs->matches->match->name, "comment") == 0) {
+		comm = true;
+		xt_xlate_add(xl, "counter ");
+	}

After my update you don't need to check if the match is comment anymore, instead you can check if xl->comment is set, if so you print the counter in first place to make sure it comes before the comment.

Please, send a v2. Thanks.