From 325af556cd3a6d1636c0cd355b494c87f58397e0 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 25 Jun 2021 22:30:42 +0200 Subject: add ipset to nftables translation infrastructure This patch provides the ipset-translate utility which allows you to translate your existing ipset file to nftables. The ipset-translate utility is actually a symlink to ipset, which checks for 'argv[0] == ipset-translate' to exercise the translation path. You can translate your ipset file through: ipset-translate restore < sets.ipt This patch reuses the existing parser and API to represent the sets and the elements. There is a new ipset_xlate_set dummy object that allows to store a created set to fetch the type without interactions with the kernel. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Jozsef Kadlecsik --- src/ipset.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'src/ipset.c') diff --git a/src/ipset.c b/src/ipset.c index ee36a06..6d42b60 100644 --- a/src/ipset.c +++ b/src/ipset.c @@ -9,9 +9,11 @@ #include /* assert */ #include /* fprintf */ #include /* exit */ +#include /* strcmp */ #include #include /* ipset library */ +#include /* translate to nftables */ int main(int argc, char *argv[]) @@ -29,7 +31,11 @@ main(int argc, char *argv[]) exit(1); } - ret = ipset_parse_argv(ipset, argc, argv); + if (!strcmp(argv[0], "ipset-translate")) { + ret = ipset_xlate_argv(ipset, argc, argv); + } else { + ret = ipset_parse_argv(ipset, argc, argv); + } ipset_fini(ipset); -- cgit v1.2.3