extensions: libxt_connlabel: Add translation to nft

PATCH In review Shivani Bhardwaj 3 participants 8 messages Mar 5, 2016 – Mar 7, 2016 netfilter

lore

Share & tools

lore

Shivani Bhardwaj

author

2016-03-05 21:47 UTC #0 lore raw

PATCH 1/1 extensions: libxt_connlabel: Add translation to nft

Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.

Examples:

$ sudo iptables-translate -A INPUT -m connlabel --label eth0-in
nft add rule ip filter INPUT ct label eth0-in counter

$ sudo iptables-translate -A INPUT -m connlabel ! --label eth0-out
nft add rule ip filter INPUT ct label != eth0-out counter

Signed-off-by Shivani Bhardwaj <[email protected]>

---
 extensions/libxt_connlabel.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

extensions/libxt_connlabel.c +23 -0

index 1f83095..c3a96a6 100644
@@ -118,6 +118,28 @@ connlabel_mt_save(const void *ip, const struct xt_entry_match *match)
 	connlabel_mt_print_op(info, "--");
 }
 
+static int
+connlabel_mt_xlate(const struct xt_entry_match *match,
+		   struct xt_xlate *xl, int numeric)
+{
+	const struct xt_connlabel_mtinfo *info = (const void *)match->data;
+	const char *name = connlabel_get_name(info->bit);
+
+	if (name)
+		xt_xlate_add(xl, "ct label %s%s ",
+			     info->options & XT_CONNLABEL_OP_INVERT ? "!= " : "",
+			     name);
+	else
+		xt_xlate_add(xl, "ct label %s%u ",
+			     info->options & XT_CONNLABEL_OP_INVERT ? "!= " : "",
+			     info->bit);
+
+	if (info->options & XT_CONNLABEL_OP_SET)
+		return 0;
+
+	return 1;
+}
+
 static struct xtables_match connlabel_mt_reg = {
 	.family        = NFPROTO_UNSPEC,
 	.name          = "connlabel",

@@ -129,6 +151,7 @@ static struct xtables_match connlabel_mt_reg = {
 	.save          = connlabel_mt_save,
 	.x6_parse      = connlabel_mt_parse,
 	.x6_options    = connlabel_mt_opts,
+	.xlate	       = connlabel_mt_xlate,
 };
 
 void _init(void)

Signature · 1 line

1.9.1

Florian Westphal

maintainer

2016-03-06 00:07 UTC #1 lore raw

Quoted 2 lines · Shivani Bhardwaj

Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.

Hmm, I sent patches for that a while ago, don't know why they were not applied... Pablo?

Quoted 4 lines

Examples:

$ sudo iptables-translate -A INPUT -m connlabel --label eth0-in
nft add rule ip filter INPUT ct label eth0-in counter

Looks good, thanks!

Quoted 2 lines

$ sudo iptables-translate -A INPUT -m connlabel ! --label eth0-out
nft add rule ip filter INPUT ct label != eth0-out counter

This one however is not correct.
It will match when eth0-out is not set, yes, but it will also match if eth0-out and something else is also set.

(!= generates

[ cmp neq reg 1 0x00000004 0x00000000 0x00000000 0x00000000 ]

This should do the same thing as the -m connlabel ! --label ... command:

nft add rule ip filter INPUT ct label & eth0-in != eth0-in counter

[ ct load label => reg 1 ]
[ bitwise reg 1 = (reg=1 & 0x00000004 0x00000000 0x00000000 0x00000000 ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ] [ cmp neq reg 1 0x00000004 0x00000000 0x00000000 0x00000000 ]

... so we load labels, then mask out everything except eth0-in, then we check that this bit was not set.

Pablo Neira Ayuso

maintainer

2016-03-07 13:05 UTC #2 lore raw

Quoted 6 lines · Florian Westphal

Quoted 2 lines · Shivani Bhardwaj
Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.
Hmm, I sent patches for that a while ago, don't know why they were not applied... Pablo?

Please, push the the connlabel support to nft.

We can probably introduce something like:

ct connlabel bitset bar

instead of:

ct connlabel set ct connlabel | bar

in a follow up patch, which looks more compact to me. We can accept both syntax I'd say so we can introduce this without breaking backward.

Shivani Bhardwaj

author

2016-03-07 13:26 UTC #3 lore raw

Quoted 14 lines · Pablo Neira Ayuso

Quoted 6 lines · Florian Westphal
Quoted 2 lines · Shivani Bhardwaj
Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.
Hmm, I sent patches for that a while ago, don't know why they were not applied... Pablo?
Please, push the the connlabel support to nft.
We can probably introduce something like:
ct connlabel bitset bar

Quoted 7 lines

instead of:
ct connlabel set ct connlabel | bar
in a follow up patch, which looks more compact to me. We can accept both syntax I'd say so we can introduce this without breaking backward.

Should I be waiting for this or send a v2 with the existing options? Please let me know.
Thanks.

Florian Westphal

maintainer

2016-03-07 13:30 UTC #4 lore raw

Quoted 17 lines · Shivani Bhardwaj

Quoted 16 lines · Pablo Neira Ayuso
Quoted 6 lines · Florian Westphal
Quoted 2 lines · Shivani Bhardwaj
Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.
Hmm, I sent patches for that a while ago, don't know why they were not applied... Pablo?
Please, push the the connlabel support to nft.
We can probably introduce something like:
ct connlabel bitset bar
instead of:

Quoted 8 lines

Quoted 5 lines
ct connlabel set ct connlabel | bar
in a follow up patch, which looks more compact to me. We can accept both syntax I'd say so we can introduce this without breaking backward.
Should I be waiting for this or send a v2 with the existing options? Please let me know.

I'd suggest you just send a v2, lets handle translation of --set in a followup change later.

I'm currently not at home but I plan to push set support this week.

Pablo Neira Ayuso

maintainer

2016-03-07 13:32 UTC #6 lore raw

In reply to Shivani Bhardwaj

Quoted 17 lines · Shivani Bhardwaj

Quoted 16 lines · Pablo Neira Ayuso
Quoted 6 lines · Florian Westphal
Quoted 2 lines · Shivani Bhardwaj
Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.
Hmm, I sent patches for that a while ago, don't know why they were not applied... Pablo?
Please, push the the connlabel support to nft.
We can probably introduce something like:
ct connlabel bitset bar
instead of:

Quoted 7 lines

Quoted 5 lines
ct connlabel set ct connlabel | bar
in a follow up patch, which looks more compact to me. We can accept both syntax I'd say so we can introduce this without breaking backward.
Should I be waiting for this or send a v2 with the existing options?

The current translation seems fine (unless Florian indicates otherwise). We can incrementally improve this.

Pablo Neira Ayuso

maintainer

2016-03-07 13:33 UTC #5 lore raw

In reply to Florian Westphal

Quoted 24 lines · Florian Westphal

Quoted 23 lines · Shivani Bhardwaj
Quoted 21 lines · Pablo Neira Ayuso
Quoted 6 lines · Florian Westphal
Quoted 2 lines · Shivani Bhardwaj
Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.
Hmm, I sent patches for that a while ago, don't know why they were not applied... Pablo?
Please, push the the connlabel support to nft.
We can probably introduce something like:
ct connlabel bitset bar
instead of:
ct connlabel set ct connlabel | bar
in a follow up patch, which looks more compact to me. We can accept both syntax I'd say so we can introduce this without breaking backward.

Quoted 7 lines

Quoted 2 lines
Should I be waiting for this or send a v2 with the existing options? Please let me know.
I'd suggest you just send a v2, lets handle translation of --set in a followup change later.
I'm currently not at home but I plan to push set support this week.

OK; then please wait to send a v2 Shivani.

Shivani Bhardwaj

author

2016-03-07 13:34 UTC #7 lore raw

In reply to Pablo Neira Ayuso

Quoted 20 lines · Pablo Neira Ayuso

Quoted 19 lines · Shivani Bhardwaj
Quoted 18 lines · Pablo Neira Ayuso
Quoted 6 lines · Florian Westphal
Quoted 2 lines · Shivani Bhardwaj
Add translation for connlabel to nftables.
Full translation for this match awaits the support for --set option.
Hmm, I sent patches for that a while ago, don't know why they were not applied... Pablo?
Please, push the the connlabel support to nft.
We can probably introduce something like:
ct connlabel bitset bar
instead of:
ct connlabel set ct connlabel | bar

Quoted 8 lines

Quoted 5 lines
Quoted 3 lines
in a follow up patch, which looks more compact to me. We can accept both syntax I'd say so we can introduce this without breaking backward.
Should I be waiting for this or send a v2 with the existing options?
The current translation seems fine (unless Florian indicates otherwise). We can incrementally improve this.

Yes, Florian pointed that the translation corresponding to inversion is incorrect. So, I already need to fix that.