diff options
| author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-07-16 18:42:24 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-07-16 16:47:51 +0200 |
| commit | cc7e0982aeb8c2e30b669457d5c062e34f1085be (patch) | |
| tree | a19c5124161dee916cbed2591a6acd51ad36f14a /extensions | |
| parent | ebca5a8151a05969ed18c060799e099c9a599b08 (diff) | |
extensions: libxt_connlabel: Add translation to nft
Add translation for connlabel to nftables.
For examples:
# iptables-translate -A INPUT -m connlabel --label bit40
nft add rule ip filter INPUT ct label bit40 counter
# iptables-translate -A INPUT -m connlabel ! --label bit40 --set
nft add rule ip filter INPUT ct label set bit40 ct label and bit40 != bit40 counter
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions')
| -rw-r--r-- | extensions/libxt_connlabel.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c index 355c99ae..7e4ff262 100644 --- a/extensions/libxt_connlabel.c +++ b/extensions/libxt_connlabel.c @@ -125,6 +125,27 @@ connlabel_mt_save(const void *ip, const struct xt_entry_match *match) connlabel_mt_print_op(info, "--"); } +static int +connlabel_mt_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_connlabel_mtinfo *info = (const void *)match->data; + const char *name = connlabel_get_name(info->bit); + + if (name == NULL) + return 0; + + if (info->options & XT_CONNLABEL_OP_SET) + xt_xlate_add(xl, "ct label set %s ", name); + + xt_xlate_add(xl, "ct label "); + if (info->options & XT_CONNLABEL_OP_INVERT) + xt_xlate_add(xl, "and %s != ", name); + xt_xlate_add(xl, "%s", name); + + return 1; +} + static struct xtables_match connlabel_mt_reg = { .family = NFPROTO_UNSPEC, .name = "connlabel", @@ -136,6 +157,7 @@ static struct xtables_match connlabel_mt_reg = { .save = connlabel_mt_save, .x6_parse = connlabel_mt_parse, .x6_options = connlabel_mt_opts, + .xlate = connlabel_mt_xlate, }; void _init(void) |