extensions: libxt_statistic: Add translation to nft

PATCH Superseded Laura Garcia Liebana 3 participants 7 messages Feb 29, 2016 – Mar 1, 2016 netfilter

lore

Share & tools

lore

Laura Garcia Liebana

author

2016-02-29 21:22 UTC #0 lore raw

PATCH 1/1 extensions: libxt_statistic: Add translation to nft

Add translation for random to nftables.

Examples:

$ iptables-translate -A INPUT -m statistic --mode random --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random 0.10000000009 counter accept

$ iptables-translate -A INPUT -m statistic --mode random ! --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random != 0.10000000009 counter accept

Signed-off-by Laura Garcia Liebana <[email protected]>

---
 extensions/libxt_statistic.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

extensions/libxt_statistic.c +15 -0

index b6ae5f5..95d588c 100644
@@ -133,6 +133,20 @@ static void statistic_save(const void *ip, const struct xt_entry_match *match)
 	print_match(info, "--");
 }
 
+static int statistic_xlate(const struct xt_entry_match *match,
+			   struct xt_xlate *xl, int numeric)
+{
+	const struct xt_statistic_info *info = (void *)match->data;
+
+	if (info->mode == XT_STATISTIC_MODE_RANDOM) {
+		xt_xlate_add(xl, "meta random%s %.11f ",
+			     (info->flags & XT_STATISTIC_INVERT) ? " !=" : "",
+			     1.0 * info->u.random.probability / 0x80000000);
+	}
+
+	return 1;
+}
+
 static struct xtables_match statistic_match = {
 	.family		= NFPROTO_UNSPEC,
 	.name		= "statistic",

@@ -145,6 +159,7 @@ static struct xtables_match statistic_match = {
 	.print		= statistic_print,
 	.save		= statistic_save,
 	.x6_options	= statistic_opts,
+	.xlate		= statistic_xlate,
 };
 
 void _init(void)

Signature · 1 line

2.7.0

Shivani Bhardwaj

2016-03-01 09:52 UTC #1 lore raw

On Tue, Mar 1, 2016 at 2:52 AM, Laura Garcia Liebana <[email protected]> wrote:

Hi Laura,

Quoted 2 lines

Add translation for random to nftables.

Here, you are providing translation for module statistic, random is just a mode for matching the rule. Please make sure to use correct module name in the commit message next time.

Quoted 10 lines

Examples:

$ iptables-translate -A INPUT -m statistic --mode random --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random 0.10000000009 counter accept

$ iptables-translate -A INPUT -m statistic --mode random ! --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random != 0.10000000009 counter accept

The match statistic is not yet supported in nftables, so these translations are not going to work. You can track the supported extensions here:
http://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables,
you can edit any discrepancies you find on this page.

Quoted 31 lines

Signed-off-by Laura Garcia Liebana <[email protected]>

---
 extensions/libxt_statistic.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

extensions/libxt_statistic.c +14 -0

index b6ae5f5..95d588c 100644
@@ -133,6 +133,20 @@ static void statistic_save(const void *ip, const struct xt_entry_match *match)
        print_match(info, "--");
 }
 
+static int statistic_xlate(const struct xt_entry_match *match,
+                          struct xt_xlate *xl, int numeric)
+{
+       const struct xt_statistic_info *info = (void *)match->data;
+
+       if (info->mode == XT_STATISTIC_MODE_RANDOM) {
+               xt_xlate_add(xl, "meta random%s %.11f ",
+                            (info->flags & XT_STATISTIC_INVERT) ? " !=" : "",
+                            1.0 * info->u.random.probability / 0x80000000);
+       }
+
+       return 1;
+}
+
 static struct xtables_match statistic_match = {
        .family         = NFPROTO_UNSPEC,
        .name           = "statistic",

extensions/libxt_statistic.c static struct xtables_match statistic_match = { · line 164

Quoted 6 lines

extensions/libxt_statistic.c +1 -0

@@ -145,6 +159,7 @@ static struct xtables_match statistic_match = {
        .print          = statistic_print,
        .save           = statistic_save,
        .x6_options     = statistic_opts,
+       .xlate          = statistic_xlate,
 };

The way you've written the code to carry out the translation is correct. Please make sure to check your patches with checkpatch to avoid coding style errors.

Thanks,
Shivani

Quoted 10 lines

extensions/libxt_statistic.c +0 -1
 void _init(void)
--
2.7.0
--
You received this message because you are subscribed to the Google Groups "outreachy-kernel" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/outreachy-kernel/20160229212216.GA29706%40sonyv.
For more options, visit https://groups.google.com/d/optout.

Pablo Neira Ayuso

maintainer

2016-03-01 10:13 UTC #2 lore raw

Quoted 21 lines · Shivani Bhardwaj

On Tue, Mar 1, 2016 at 2:52 AM, Laura Garcia Liebana <[email protected]> wrote:
Hi Laura,
Quoted 2 lines
Add translation for random to nftables.
Here, you are providing translation for module statistic, random is just a mode for matching the rule. Please make sure to use correct module name in the commit message next time.
Quoted 10 lines
Examples:
$ iptables-translate -A INPUT -m statistic --mode random --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random 0.10000000009 counter accept
$ iptables-translate -A INPUT -m statistic --mode random ! --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random != 0.10000000009 counter accept

Quoted 5 lines

The match statistic is not yet supported in nftables, so these translations are not going to work. You can track the supported extensions here:
http://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables,
you can edit any discrepancies you find on this page.

I'm seeing here that there are partial translations that are not in the tree.

I would like to have them merged upstream, no need to wait to fully support every extension, we can document these limitations in the wiki and the commit log.

IIRC, if the .xlate indirection returns 0, then it means no translation is available. We can use that for things that we don't support yet.

Laura Garcia

author

2016-03-01 15:57 UTC #3 lore raw

Quoted 9 lines · Pablo Neira Ayuso

I would like to have them merged upstream, no need to wait to fully support every extension, we can document these limitations in the wiki and the commit log.
IIRC, if the .xlate indirection returns 0, then it means no translation is available. We can use that for things that we don't support yet.

Hi Pablo, should I have to include this in the patch?

Thanks.

Pablo Neira Ayuso

maintainer

2016-03-01 19:00 UTC #4 lore raw

Quoted 6 lines · Laura Garcia

Quoted 5 lines · Pablo Neira Ayuso
I would like to have them merged upstream, no need to wait to fully support every extension, we can document these limitations in the wiki and the commit log.

Quoted 6 lines

Quoted 4 lines
IIRC, if the .xlate indirection returns 0, then it means no translation is available. We can use that for things that we don't support yet.
Hi Pablo, should I have to include this in the patch?

Yes please.

Address Shivani's feedback and send a v2. Thanks Laura.

Laura Garcia

author

2016-03-01 15:49 UTC #5 lore raw

In reply to Shivani Bhardwaj

Quoted 10 lines · Shivani Bhardwaj

On Tue, Mar 1, 2016 at 2:52 AM, Laura Garcia Liebana <[email protected]> wrote:
Hi Laura,
Quoted 2 lines
Add translation for random to nftables.
Here, you are providing translation for module statistic, random is just a mode for matching the rule. Please make sure to use correct module name in the commit message next time.

Hi Shivani,

The translation is only for random due to the mode nth is not implemented in nft yet.

Quoted 11 lines

Quoted 10 lines

Examples:

$ iptables-translate -A INPUT -m statistic --mode random --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random 0.10000000009 counter accept

$ iptables-translate -A INPUT -m statistic --mode random ! --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random != 0.10000000009 counter accept

Quoted 6 lines

The match statistic is not yet supported in nftables, so these translations are not going to work. You can track the supported extensions here:
http://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables,
you can edit any discrepancies you find on this page.

The nf-next branch includes the random feature and it's working perfectly for me. Should I have to update something in the wiki?

Quoted 30 lines

Signed-off-by Laura Garcia Liebana <[email protected]>

---
 extensions/libxt_statistic.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

extensions/libxt_statistic.c +14 -0

index b6ae5f5..95d588c 100644
@@ -133,6 +133,20 @@ static void statistic_save(const void *ip, const struct xt_entry_match *match)
        print_match(info, "--");
 }
 
+static int statistic_xlate(const struct xt_entry_match *match,
+                          struct xt_xlate *xl, int numeric)
+{
+       const struct xt_statistic_info *info = (void *)match->data;
+
+       if (info->mode == XT_STATISTIC_MODE_RANDOM) {
+               xt_xlate_add(xl, "meta random%s %.11f ",
+                            (info->flags & XT_STATISTIC_INVERT) ? " !=" : "",
+                            1.0 * info->u.random.probability / 0x80000000);
+       }
+
+       return 1;
+}
+
 static struct xtables_match statistic_match = {
        .family         = NFPROTO_UNSPEC,
        .name           = "statistic",

Quoted 8 lines

extensions/libxt_statistic.c static struct xtables_match statistic_match = { · line 164
Quoted 7 lines
extensions/libxt_statistic.c +1 -0
@@ -145,6 +159,7 @@ static struct xtables_match statistic_match = {
        .print          = statistic_print,
        .save           = statistic_save,
        .x6_options     = statistic_opts,
+       .xlate          = statistic_xlate,
 };
 
The way you've written the code to carry out the translation is correct.

Ok, thanks for your confirmation.

Quoted 3 lines

Please make sure to check your patches with checkpatch to avoid coding style errors.

Sure,

Thanks!

Quoted 13 lines

Thanks,
Shivani
Quoted 10 lines
extensions/libxt_statistic.c +0 -1
 void _init(void)
--
2.7.0
--
You received this message because you are subscribed to the Google Groups "outreachy-kernel" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/outreachy-kernel/20160229212216.GA29706%40sonyv.
For more options, visit https://groups.google.com/d/optout.

Pablo Neira Ayuso

maintainer

2016-03-01 19:21 UTC #6 lore raw

Quoted 35 lines · Laura Garcia

Quoted 10 lines · Shivani Bhardwaj
On Tue, Mar 1, 2016 at 2:52 AM, Laura Garcia Liebana <[email protected]> wrote:
Hi Laura,
Quoted 2 lines
Add translation for random to nftables.
Here, you are providing translation for module statistic, random is just a mode for matching the rule. Please make sure to use correct module name in the commit message next time.
Hi Shivani,
The translation is only for random due to the mode nth is not implemented in nft yet.
Quoted 11 lines
Quoted 10 lines
Examples:
$ iptables-translate -A INPUT -m statistic --mode random --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random 0.10000000009 counter accept
$ iptables-translate -A INPUT -m statistic --mode random ! --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random != 0.10000000009 counter accept
Quoted 6 lines
The match statistic is not yet supported in nftables, so these translations are not going to work. You can track the supported extensions here:
http://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables,
you can edit any discrepancies you find on this page.

Quoted 2 lines

The nf-next branch includes the random feature and it's working perfectly for me. Should I have to update something in the wiki?

The nf-next tree is OK for this. The sooner we get a translation, the better.

Yes please, update the wiki page once this hits the master branch.

Thanks.