extensions: libxt_cgroup: Add translation to nft
PATCH 1/1 extensions: libxt_cgroup: Add translation to nft
Add translation for the network classifier cgroup to nftables.
Examples:
$ sudo iptables-translate -A input -m cgroup --cgroup 0x100001 -j DROP nft add rule ip filter input meta cgroup 1048577 counter drop
$ sudo iptables-translate -A input -m cgroup ! --cgroup 0x100001 -j DROP nft add rule ip filter input meta cgroup != 1048577 counter drop
Signed-off-by Shivani Bhardwaj <[email protected]>
--- extensions/libxt_cgroup.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
extensions/libxt_cgroup.c +12 -0
@@ -48,6 +48,17 @@ static void cgroup_save(const void *ip, const struct xt_entry_match *match)printf ("%s --cgroup %u" , info->invert ?" !" :"" , info->id); } +static int cgroup_xlate (const struct xt_entry_match *match, +struct xt_buf *buf,int numeric) +{ +const struct xt_cgroup_info *info = (void *) match->data; + +xt_buf_add (buf,"meta cgroup%s %u " , + info->invert ?" !=" :"" , info->id); + +return 1 ; +} +static struct xtables_match cgroup_match = { .family =NFPROTO_UNSPEC , .name ="cgroup" ,
@@ -59,6 +70,7 @@ static struct xtables_match cgroup_match = { .save = cgroup_save, .x6_parse = cgroup_parse, .x6_options = cgroup_opts, + .xlate = cgroup_xlate, };void _init (void )
Signature · 1 line
1.9.1
Pablo Neira Ayuso
maintainerQuoted 9 lines · Shivani Bhardwaj
Add translation for the network classifier cgroup to nftables.
Examples:
$ sudo iptables-translate -A input -m cgroup --cgroup 0x100001 -j DROP nft add rule ip filter input meta cgroup 1048577 counter drop$ sudo iptables-translate -A input -m cgroup ! --cgroup 0x100001 -j DROP nft add rule ip filter input meta cgroup != 1048577 counter drop
Please, rebase upon the xlate4 branch. Tejun sent us the cgroups2 updates and this patch doesn't apply on top of those.
Thanks Shivani.