summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorShivani Bhardwaj <shivanib134@gmail.com>2016-02-24 01:19:34 +0530
committerPablo Neira Ayuso <pablo@netfilter.org>2016-02-29 13:32:48 +0100
commita9a599ab675b8feb942355a24934901a9adcef1b (patch)
tree872d0db62e83241488d4742e5a3760ae11e05869
parent3bc0951c107c5da741a330ba5df49a2c823f5e5d (diff)
comment: Add translation to nft
Add translation for match comment to nftables. This patch also adds the relevant infrastructure for carrying out the translation. Example: $ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block" nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\" Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--extensions/libxt_comment.c13
-rw-r--r--include/xtables.h1
-rw-r--r--iptables/nft-ipv4.c5
-rw-r--r--iptables/nft-ipv6.c5
-rw-r--r--libxtables/xtables.c5
5 files changed, 29 insertions, 0 deletions
diff --git a/extensions/libxt_comment.c b/extensions/libxt_comment.c
index 6ed2ff9b..3fcb8b46 100644
--- a/extensions/libxt_comment.c
+++ b/extensions/libxt_comment.c
@@ -48,6 +48,18 @@ comment_save(const void *ip, const struct xt_entry_match *match)
xtables_save_string(commentinfo->comment);
}
+static int
+comment_xlate(const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ struct xt_comment_info *commentinfo = (void *)match->data;
+
+ commentinfo->comment[XT_MAX_COMMENT_LEN - 1] = '\0';
+ xt_xlate_add_comment(xl, commentinfo->comment);
+
+ return 1;
+}
+
static struct xtables_match comment_match = {
.family = NFPROTO_UNSPEC,
.name = "comment",
@@ -59,6 +71,7 @@ static struct xtables_match comment_match = {
.save = comment_save,
.x6_parse = xtables_option_parse,
.x6_options = comment_opts,
+ .xlate = comment_xlate,
};
void _init(void)
diff --git a/include/xtables.h b/include/xtables.h
index 6fd3bdfc..e219c9f9 100644
--- a/include/xtables.h
+++ b/include/xtables.h
@@ -574,6 +574,7 @@ struct xt_xlate *xt_xlate_alloc(int size);
void xt_xlate_free(struct xt_xlate *xl);
void xt_xlate_add(struct xt_xlate *xl, const char *fmt, ...);
void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment);
+const char *xt_xlate_get_comment(struct xt_xlate *xl);
const char *xt_xlate_get(struct xt_xlate *xl);
#ifdef XTABLES_INTERNAL
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 5e2857d3..cf985b73 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -432,6 +432,7 @@ static void nft_ipv4_save_counters(const void *data)
static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
{
const struct iptables_command_state *cs = data;
+ const char *comment;
int ret;
if (cs->fw.ip.iniface[0] != '\0') {
@@ -484,6 +485,10 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
/* Always add counters per rule, as in iptables */
xt_xlate_add(xl, "counter ");
+ comment = xt_xlate_get_comment(xl);
+ if (comment)
+ xt_xlate_add(xl, "comment \\\"%s\\\" ", comment);
+
ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
return ret;
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 0ee79575..92d37a02 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -392,6 +392,7 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr,
static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
{
const struct iptables_command_state *cs = data;
+ const char *comment;
int ret;
if (cs->fw6.ipv6.iniface[0] != '\0') {
@@ -435,6 +436,10 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
/* Always add counters per rule, as in iptables */
xt_xlate_add(xl, "counter ");
+ comment = xt_xlate_get_comment(xl);
+ if (comment)
+ xt_xlate_add(xl, "comment \\\"%s\\\" ", comment);
+
ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl);
return ret;
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index c4b86f51..fe24caa2 100644
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -2045,6 +2045,11 @@ void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment)
xl->comment[NFT_USERDATA_MAXLEN - 1] = '\0';
}
+const char *xt_xlate_get_comment(struct xt_xlate *xl)
+{
+ return xl->comment[0] ? xl->comment : NULL;
+}
+
const char *xt_xlate_get(struct xt_xlate *xl)
{
return xl->buf.data;