From cc7e0982aeb8c2e30b669457d5c062e34f1085be Mon Sep 17 00:00:00 2001 From: Liping Zhang Date: Sat, 16 Jul 2016 18:42:24 +0800 Subject: extensions: libxt_connlabel: Add translation to nft Add translation for connlabel to nftables. For examples: # iptables-translate -A INPUT -m connlabel --label bit40 nft add rule ip filter INPUT ct label bit40 counter # iptables-translate -A INPUT -m connlabel ! --label bit40 --set nft add rule ip filter INPUT ct label set bit40 ct label and bit40 != bit40 counter Signed-off-by: Liping Zhang Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_connlabel.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'extensions/libxt_connlabel.c') diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c index 355c99ae..7e4ff262 100644 --- a/extensions/libxt_connlabel.c +++ b/extensions/libxt_connlabel.c @@ -125,6 +125,27 @@ connlabel_mt_save(const void *ip, const struct xt_entry_match *match) connlabel_mt_print_op(info, "--"); } +static int +connlabel_mt_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_connlabel_mtinfo *info = (const void *)match->data; + const char *name = connlabel_get_name(info->bit); + + if (name == NULL) + return 0; + + if (info->options & XT_CONNLABEL_OP_SET) + xt_xlate_add(xl, "ct label set %s ", name); + + xt_xlate_add(xl, "ct label "); + if (info->options & XT_CONNLABEL_OP_INVERT) + xt_xlate_add(xl, "and %s != ", name); + xt_xlate_add(xl, "%s", name); + + return 1; +} + static struct xtables_match connlabel_mt_reg = { .family = NFPROTO_UNSPEC, .name = "connlabel", @@ -136,6 +157,7 @@ static struct xtables_match connlabel_mt_reg = { .save = connlabel_mt_save, .x6_parse = connlabel_mt_parse, .x6_options = connlabel_mt_opts, + .xlate = connlabel_mt_xlate, }; void _init(void) -- cgit v1.2.3