summaryrefslogtreecommitdiffstats
path: root/extensions/libxt_CONNMARK.c
Commit message (Collapse)AuthorAgeFilesLines
* extensions: connmark: remove non-working translationFlorian Westphal2018-02-201-12/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ... and return 0 so output reflects that no translation was performed. iptables-translate -A I -j CONNMARK --save-mark --mask 0xff nft # -A I -j CONNMARK --save-mark --mask 0xff The translation that was performed: nft add rule ip mangle PREROUTING counter meta mark set ct mark and 0xff will clear (zero) most bits: [ meta load mark => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000ff ) ^ 0x00000000 ] [ ct set mark with reg 1 ] The xtables module however does this: newmark = (ct->mark & ~info->ctmask) ^ (skb->mark & info->nfmask); I.e., for ctmark mask defines what to clear, for nfmark what to keep, i.e. we're supposed to only alter the lower bits of the ctmark. nftables can't do this at the moment because bitwise operator RHS requires immediate values. same is true for 'restore'. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: prefer plain 'set' over 'set mark and'Florian Westphal2018-02-201-3/+3
| | | | | | | | | | | | | | adding a test case for MARK --set-mark 0 fails with exp: nft add rule ip mangle OUTPUT counter meta mark set 0x0 res: nft add rule ip mangle OUTPUT counter meta mark set mark and 0x0 This translation isn't wrong, but unneccessarily complex, so change order to first check if mask bits are all ones. In that case we can simply use an immediate value without need for logical operators. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: introduce struct xt_xlate_{mt,tg}_paramsPablo Neira Ayuso2016-07-251-4/+4
| | | | | | | | This structure is an extensible containers of parameters, so we don't need to propagate interface updates in every extension file in case we need to add new parameters in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_CONNMARK: Add translation to nftRoberto García2016-06-221-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add translation for the CONNMARK target to nftables. The following options have no available translation: --save-mark [--nfmask nfmask] [--ctmask ctmask] --restore-mark [--nfmask nfmask] [--ctmask ctmask] Examples: # iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0x16 nft add rule ip mangle PREROUTING counter ct mark set 0x16 # iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-xmark 0x16/0x12 nft add rule ip mangle PREROUTING counter ct mark set ct mark xor 0x16 and 0xffffffed # iptables-translate -t mangle -A PREROUTING -j CONNMARK --and-mark 0x16 nft add rule ip mangle PREROUTING counter ct mark set ct mark and 0x16 # iptables-translate -t mangle -A PREROUTING -j CONNMARK --or-mark 0x16 nft add rule ip mangle PREROUTING counter ct mark set ct mark or 0x16 # iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark nft add rule ip mangle PREROUTING counter ct mark set mark # iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark \ --mask 0x12 nft add rule ip mangle PREROUTING counter ct mark set mark and 0x12 # iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark nft add rule ip mangle PREROUTING counter meta mark set ct mark # iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark \ --mask 0x12 nft add rule ip mangle PREROUTING counter meta mark set ct mark and 0x12 Signed-off-by: Roberto García <rodanber@gmail.com> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* update FSF address in license textJiri Popelka2014-03-131-1/+1
| | | | | | | http://www.gnu.org/licenses/gpl-2.0.html http://www.fsf.org/about/contact/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_CONNMARK: use guided option parserJan Engelhardt2011-04-131-163/+108
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: do not print trailing whitespacesJan Engelhardt2011-01-311-27/+24
| | | | | | | | | | | | | | | | | Due to the use of printf("foobar "), iptables emits spaces at the end-of-line, which looks odd to some users because it causes the terminal to wrap even if there is seemingly nothing to print. It may also have other points of annoyance, such as mailers interpreting a trailing space as an indicator that the paragraph continues when format=flowed is also on. And git highlights trailing spaces in red, so let's avoid :) Preexisting inconsistencies in outputting spaces in the right spot are also addressed right away. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429579 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove no longer necessary default: casesJan Engelhardt2011-01-081-2/+0
| | | | | | | Match and target parse functions now only get option characters they have defined themselves. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: use C99/POSIX typesJan Engelhardt2011-01-081-2/+2
| | | | | | "u_int" was a non-standardized extension predating C99 on some platforms. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* all: consistent syntax use in struct optionJan Engelhardt2010-07-231-6/+7
| | | | | | Try to inhibit copypasting old stuff. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* includes: header updatesJan Engelhardt2010-02-011-0/+6
| | | | | | | | | | | | Update the shipped Linux kernel headers from 2.6.33-rc6, as iptables's ipt_ECN.h for example references ipt_DSCP.h, which no longer exists. Since a number of old code pieces have been removed in the kernel in that fashion, the structs for older versions are moved into the .c file, to keep header updating simple. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* CONNMARK: print mark rules with mask 0xffffffff as set instead of xsetJan Engelhardt2009-11-041-0/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: collapse data variables to use multi-reg callsJan Engelhardt2009-06-261-32/+32
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: collapse registration structuresJan Engelhardt2009-06-261-36/+2
| | | | | | | | | | | | There are no different code paths between IPV4 and IPV6, so data can be consolidated here. text data bss dec hex filename 243757 12212 2576 258545 3f1f1 ip6tables-static[before.i586] 243613 9428 2576 255617 3e681 ip6tables-static[after.i586] -144 -2784 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix exit_error to xtables_errorJan Engelhardt2009-02-211-10/+10
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - param_actJan Engelhardt2009-01-301-15/+15
| | | | | | | | Changes: exittype -> xtables_exittype P_* -> XTF_* flags Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - strtouiJan Engelhardt2009-01-271-8/+8
| | | | | | This commit also throws out the redundant string_to_number_*. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: use UINT_MAX constants over open-coded bits (1/2)Jan Engelhardt2009-01-271-13/+13
| | | | | | ~0 depends on the sizeof(int), so it is better to use UINT32_MAX. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: use NFPROTO_ constantsJan Engelhardt2008-11-181-4/+4
| | | | | | | | Resync netfilter.h from the latest kernel and make use of the new NFPROTO_ constants that have been introduced. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: Update commentsJan Engelhardt2008-09-011-6/+0
| | | | | | | | A number of comments are redundant, some outdated and others outright wrong in their own way. Remove and fixup. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Remove old functions, constantsJan Engelhardt2008-04-151-8/+6
|
* fix gcc warningsMax Kellermann2008-01-291-2/+2
| | | | Max Kellermann <max@duempel.org>
* libxt_CONNMARK revision 1Jan Engelhardt2008-01-291-8/+256
| | | | | | Add support for xt_CONNMARK target revision 1. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* Fix CONNMARK mask initialisationPeter Warasin2008-01-151-2/+10
| | | | | | | | | | This patch fixes the problem that the CONNMARK mask value has been set to 0 whenever the CONNMARK target options were not the last options to be processed. It initalizes the mask value rather than setting it for each parse. Signed-off-by: Peter Warasin <peter@endian.com>
* Unique names 2/6Jan Engelhardt2007-10-041-26/+20
| | | | | | | | | | | Give symbols of libxt targets unique names (1/3). Adds unique prefixes to all functions (most of them - especially the hook functions) so that debugging programs can unambiguously map a symbol to an address. Also unifies the names of the xtables_match/xtables_target structs, (based upon libxt_connmark.c/libip6t_*.c). Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Delete empty ->init() functionsJan Engelhardt2007-10-041-8/+0
| | | | | | | Deletes empty ->init() functions. ip[6]tables already checks for .init being NULL or not. Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Fix sparse warnings: non-ANSI function declarations, 0 used as pointerPatrick McHardy2007-09-081-5/+5
|
* Remove last vestiges of NFC (Peter Riley <Peter.Riley@hotpop.com>)Peter Riley2007-09-021-1/+1
|
* Add IPv6 support to CONNMARK matchYasuyuki KOZAKAI2007-08-041-0/+237
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-12 18:16:41 +0000