diff options
author | Laura Garcia Liebana <nevola@gmail.com> | 2016-06-06 20:51:04 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-06-07 00:40:04 +0200 |
commit | cd11b62b477dc4563892d167ca58abfc637cdb1f (patch) | |
tree | 50334c0e50cdf3f4b2a2a4350f62d1dec69210c6 /extensions/libxt_dscp.c | |
parent | 8dbc8b37bd6f44841dab72df43b09c082b01f462 (diff) |
extensions: libxt_dscp: Add translation to nft
Add translation for dscp to nftables, for both ipv4 and ipv6.
Examples:
$ sudo iptables-translate -t filter -A INPUT -m dscp --dscp 0x32 -j ACCEPT
nft add rule ip filter INPUT ip dscp 0x32 counter accept
$ sudo ip6tables-translate -t filter -A INPUT -m dscp ! --dscp 0x32 -j ACCEPT
nft add rule ip6 filter INPUT ip6 dscp != 0x32 counter accept
Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_dscp.c')
-rw-r--r-- | extensions/libxt_dscp.c | 71 |
1 files changed, 58 insertions, 13 deletions
diff --git a/extensions/libxt_dscp.c b/extensions/libxt_dscp.c index 02b22a4e..adc78277 100644 --- a/extensions/libxt_dscp.c +++ b/extensions/libxt_dscp.c @@ -91,21 +91,66 @@ static void dscp_save(const void *ip, const struct xt_entry_match *match) printf("%s --dscp 0x%02x", dinfo->invert ? " !" : "", dinfo->dscp); } -static struct xtables_match dscp_match = { - .family = NFPROTO_UNSPEC, - .name = "dscp", - .version = XTABLES_VERSION, - .size = XT_ALIGN(sizeof(struct xt_dscp_info)), - .userspacesize = XT_ALIGN(sizeof(struct xt_dscp_info)), - .help = dscp_help, - .print = dscp_print, - .save = dscp_save, - .x6_parse = dscp_parse, - .x6_fcheck = dscp_check, - .x6_options = dscp_opts, +static int __dscp_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_dscp_info *dinfo = + (const struct xt_dscp_info *)match->data; + + xt_xlate_add(xl, "dscp %s0x%02x ", dinfo->invert ? "!= " : "", + dinfo->dscp); + + return 1; +} + +static int dscp_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + xt_xlate_add(xl, "ip "); + + return __dscp_xlate(ip, match, xl, numeric); +} + +static int dscp_xlate6(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + xt_xlate_add(xl, "ip6 "); + + return __dscp_xlate(ip, match, xl, numeric); +} + +static struct xtables_match dscp_mt_reg[] = { + { + .family = NFPROTO_IPV4, + .name = "dscp", + .version = XTABLES_VERSION, + .size = XT_ALIGN(sizeof(struct xt_dscp_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_dscp_info)), + .help = dscp_help, + .print = dscp_print, + .save = dscp_save, + .x6_parse = dscp_parse, + .x6_fcheck = dscp_check, + .x6_options = dscp_opts, + .xlate = dscp_xlate, + }, + { + .family = NFPROTO_IPV6, + .name = "dscp", + .version = XTABLES_VERSION, + .size = XT_ALIGN(sizeof(struct xt_dscp_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_dscp_info)), + .help = dscp_help, + .print = dscp_print, + .save = dscp_save, + .x6_parse = dscp_parse, + .x6_fcheck = dscp_check, + .x6_options = dscp_opts, + .xlate = dscp_xlate6, + }, }; void _init(void) { - xtables_register_match(&dscp_match); + xtables_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg)); } |