[PATCH] extensions: libxt_MARK: Add translation to nft

[PATCH] extensions: libxt_MARK: Add translation to nft

[Shivani Bhardwaj]

Add translation for target MARK to nftables.

Examples:

$ sudo iptables-translate -t mangle -A PREROUTING -j MARK --set-mark 12
nft add rule ip mangle PREROUTING counter mark set 0xc

$ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 22 -j MARK --set-mark 2
nft add rule ip mangle PREROUTING tcp dport 22 counter mark set 0x2

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libxt_MARK.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
index 556dbde..c5de763 100644
--- a/extensions/libxt_MARK.c
+++ b/extensions/libxt_MARK.c
@@ -242,7 +242,24 @@ static void mark_tg_save(const void *ip, const struct xt_entry_target *target)
 {
 	const struct xt_mark_tginfo2 *info = (const void *)target->data;
 
-	printf(" --set-xmark 0x%x/0x%x", info->mark, info->mask);
+	printf(" --set mark 0x%x/0x%x", info->mark, info->mask);
+}
+
+static void
+print_mark_xlate(unsigned long mark, struct xt_buf *buf)
+{
+	xt_buf_add(buf, " 0x%lx", mark);
+}
+
+static int mark_tg_xlate(const struct xt_entry_target *target,
+			  struct xt_buf *buf, int numeric)
+{
+	const struct xt_mark_tginfo2 *info = (const void *)target->data;
+
+	xt_buf_add(buf, "mark set");
+	print_mark_xlate(info->mark, buf);
+
+	return 1;
 }
 
 static struct xtables_target mark_tg_reg[] = {
@@ -259,6 +276,7 @@ static struct xtables_target mark_tg_reg[] = {
 		.x6_parse      = MARK_parse_v0,
 		.x6_fcheck     = MARK_check,
 		.x6_options    = MARK_opts,
+		.xlate	       = mark_tg_xlate,
 	},
 	{
 		.family        = NFPROTO_IPV4,
@@ -273,6 +291,7 @@ static struct xtables_target mark_tg_reg[] = {
 		.x6_parse      = MARK_parse_v1,
 		.x6_fcheck     = MARK_check,
 		.x6_options    = MARK_opts,
+		.xlate	       = mark_tg_xlate,
 	},
 	{
 		.version       = XTABLES_VERSION,
@@ -287,6 +306,7 @@ static struct xtables_target mark_tg_reg[] = {
 		.x6_parse      = mark_tg_parse,
 		.x6_fcheck     = mark_tg_check,
 		.x6_options    = mark_tg_opts,
+		.xlate	       = mark_tg_xlate,
 	},
 };
 
-- 
1.9.1

Re: [PATCH] extensions: libxt_MARK: Add translation to nft

[Shivani Bhardwaj]

On Wed, Dec 23, 2015 at 9:03 PM, Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> Add translation for target MARK to nftables.
>
> Examples:
>
> $ sudo iptables-translate -t mangle -A PREROUTING -j MARK --set-mark 12
> nft add rule ip mangle PREROUTING counter mark set 0xc
>
> $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 22 -j MARK --set-mark 2
> nft add rule ip mangle PREROUTING tcp dport 22 counter mark set 0x2
>
> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
> ---
>  extensions/libxt_MARK.c | 22 +++++++++++++++++++++-
>  1 file changed, 21 insertions(+), 1 deletion(-)
>
> diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
> index 556dbde..c5de763 100644
> --- a/extensions/libxt_MARK.c
> +++ b/extensions/libxt_MARK.c
> @@ -242,7 +242,24 @@ static void mark_tg_save(const void *ip, const struct xt_entry_target *target)
>  {
>         const struct xt_mark_tginfo2 *info = (const void *)target->data;
>
> -       printf(" --set-xmark 0x%x/0x%x", info->mark, info->mask);
> +       printf(" --set mark 0x%x/0x%x", info->mark, info->mask);
> +}
> +
> +static void
> +print_mark_xlate(unsigned long mark, struct xt_buf *buf)
> +{
> +       xt_buf_add(buf, " 0x%lx", mark);
> +}
> +
> +static int mark_tg_xlate(const struct xt_entry_target *target,
> +                         struct xt_buf *buf, int numeric)
> +{
> +       const struct xt_mark_tginfo2 *info = (const void *)target->data;
> +
> +       xt_buf_add(buf, "mark set");
> +       print_mark_xlate(info->mark, buf);
> +
> +       return 1;
>  }
>
>  static struct xtables_target mark_tg_reg[] = {
> @@ -259,6 +276,7 @@ static struct xtables_target mark_tg_reg[] = {
>                 .x6_parse      = MARK_parse_v0,
>                 .x6_fcheck     = MARK_check,
>                 .x6_options    = MARK_opts,
> +               .xlate         = mark_tg_xlate,
>         },
>         {
>                 .family        = NFPROTO_IPV4,
> @@ -273,6 +291,7 @@ static struct xtables_target mark_tg_reg[] = {
>                 .x6_parse      = MARK_parse_v1,
>                 .x6_fcheck     = MARK_check,
>                 .x6_options    = MARK_opts,
> +               .xlate         = mark_tg_xlate,
>         },
>         {
>                 .version       = XTABLES_VERSION,
> @@ -287,6 +306,7 @@ static struct xtables_target mark_tg_reg[] = {
>                 .x6_parse      = mark_tg_parse,
>                 .x6_fcheck     = mark_tg_check,
>                 .x6_options    = mark_tg_opts,
> +               .xlate         = mark_tg_xlate,
>         },
>  };
>
> --
> 1.9.1
>

Hi,

I'm unsure if the options or-set, and-set are supported in nftables. I
cannot find much about them. Please let me know if there are
translations corresponding to these options as well, I'll send another
patch then.

Thank you

Re: [PATCH] extensions: libxt_MARK: Add translation to nft

[Jan Engelhardt]

On Wednesday 2015-12-23 16:33, Shivani Bhardwaj wrote:
>+++ b/extensions/libxt_MARK.c
>@@ -242,7 +242,24 @@ static void mark_tg_save(const void *ip, const struct xt_entry_target *target)
> {
> 	const struct xt_mark_tginfo2 *info = (const void *)target->data;
> 
>-	printf(" --set-xmark 0x%x/0x%x", info->mark, info->mask);
>+	printf(" --set mark 0x%x/0x%x", info->mark, info->mask);
>+}

This looks like it will break regular iptables.

Re: [PATCH] extensions: libxt_MARK: Add translation to nft

[Shivani Bhardwaj]

On Wed, Dec 23, 2015 at 9:45 PM, Jan Engelhardt <jengelh@inai.de> wrote:
>
> On Wednesday 2015-12-23 16:33, Shivani Bhardwaj wrote:
>>+++ b/extensions/libxt_MARK.c
>>@@ -242,7 +242,24 @@ static void mark_tg_save(const void *ip, const struct xt_entry_target *target)
>> {
>>       const struct xt_mark_tginfo2 *info = (const void *)target->data;
>>
>>-      printf(" --set-xmark 0x%x/0x%x", info->mark, info->mask);
>>+      printf(" --set mark 0x%x/0x%x", info->mark, info->mask);
>>+}
>
> This looks like it will break regular iptables.

This is my mistake. I'm correcting this. Could you please tell about
the options or-, and-, mark? Does nftables have an option
corresponding to these?

Thank you

Re: [PATCH] extensions: libxt_MARK: Add translation to nft

[Florian Westphal]

Shivani Bhardwaj <shivanib134@gmail.com> wrote:
> I'm unsure if the options or-set, and-set are supported in nftables. I
> cannot find much about them. Please let me know if there are
> translations corresponding to these options as well, I'll send another
> patch then.

You have to combine another mark + binop, i.e.:

filter input mark set mark or 1
  [ meta load mark => reg 1 ]
  [ bitwise reg 1 = (reg=1 & 0xfffffffe ) ^ 0x00000001 ]
  [ meta set mark with reg 1 ]

i.e., load mark into register, or with 1 (or whatever),
then set new mark based on result.

Replace or with and to get --and-mark.

Re: [PATCH] extensions: libxt_MARK: Add translation to nft

[Pablo Neira Ayuso]

On Wed, Dec 23, 2015 at 09:03:53PM +0530, Shivani Bhardwaj wrote:
>  static struct xtables_target mark_tg_reg[] = {
> @@ -259,6 +276,7 @@ static struct xtables_target mark_tg_reg[] = {
>  		.x6_parse      = MARK_parse_v0,
>  		.x6_fcheck     = MARK_check,
>  		.x6_options    = MARK_opts,
> +		.xlate	       = mark_tg_xlate,
>  	},
>  	{
>  		.family        = NFPROTO_IPV4,
> @@ -273,6 +291,7 @@ static struct xtables_target mark_tg_reg[] = {
>  		.x6_parse      = MARK_parse_v1,
>  		.x6_fcheck     = MARK_check,
>  		.x6_options    = MARK_opts,
> +		.xlate	       = mark_tg_xlate,
>  	},
>  	{
>  		.version       = XTABLES_VERSION,
> @@ -287,6 +306,7 @@ static struct xtables_target mark_tg_reg[] = {
>  		.x6_parse      = mark_tg_parse,
>  		.x6_fcheck     = mark_tg_check,
>  		.x6_options    = mark_tg_opts,
> +		.xlate	       = mark_tg_xlate,
>  	},

Same comment as for connmark. Please send v2.

Re: [PATCH] extensions: libxt_mark: Add translation to nft

[Shivani Bhardwaj]

On Sun, Dec 6, 2015 at 4:44 AM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Sat, Dec 05, 2015 at 08:14:09PM +0100, Pablo Neira Ayuso wrote:
>> Hi Shivani,
>>
>> On Sat, Dec 05, 2015 at 06:49:36PM +0530, Shivani Bhardwaj wrote:
>> > Add translation of the metainformation mark to nft.
>> >
>> > Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
>> > ---
>> >  extensions/libxt_mark.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++
>> >  1 file changed, 60 insertions(+)
>> >
>> > diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c
>> > index 7f8c995..5105bf9 100644
>> > --- a/extensions/libxt_mark.c
>> > +++ b/extensions/libxt_mark.c
>> > @@ -102,6 +102,64 @@ mark_save(const void *ip, const struct xt_entry_match *match)
>> >     print_mark(info->mark, info->mask);
>> >  }
>> >
>> > +static void
>> > +print_mark_xlate(struct xt_buf *buf,
>> > +            unsigned int mark, unsigned int mask)
>> > +{
>> > +        if (mask != 0xffffffffU)
>> > +                xt_buf_add(buf, " 0x%x/0x%x", mark, mask);
>>
>> In nftables this should be translated to &.
>
> I mean:
>         xt_buf_add(buf, " & x%x == x%x", mask, mark);

OK. I'm sending version 2. Please check it.

Thank you

Re: [PATCH] extensions: libxt_mark: Add translation to nft

[Pablo Neira Ayuso]

On Sat, Dec 05, 2015 at 08:14:09PM +0100, Pablo Neira Ayuso wrote:
> Hi Shivani,
> 
> On Sat, Dec 05, 2015 at 06:49:36PM +0530, Shivani Bhardwaj wrote:
> > Add translation of the metainformation mark to nft.
> > 
> > Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
> > ---
> >  extensions/libxt_mark.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 60 insertions(+)
> > 
> > diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c
> > index 7f8c995..5105bf9 100644
> > --- a/extensions/libxt_mark.c
> > +++ b/extensions/libxt_mark.c
> > @@ -102,6 +102,64 @@ mark_save(const void *ip, const struct xt_entry_match *match)
> >  	print_mark(info->mark, info->mask);
> >  }
> >  
> > +static void
> > +print_mark_xlate(struct xt_buf *buf,
> > +		 unsigned int mark, unsigned int mask)
> > +{
> > +        if (mask != 0xffffffffU)
> > +                xt_buf_add(buf, " 0x%x/0x%x", mark, mask);
> 
> In nftables this should be translated to &.

I mean:
        xt_buf_add(buf, " & x%x == x%x", mask, mark);

Re: [PATCH] extensions: libxt_mark: Add translation to nft

[Shivani Bhardwaj]

On Sun, Dec 6, 2015 at 12:44 AM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Hi Shivani,
>
> On Sat, Dec 05, 2015 at 06:49:36PM +0530, Shivani Bhardwaj wrote:
>> Add translation of the metainformation mark to nft.
>>
>> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
>> ---
>>  extensions/libxt_mark.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++
>>  1 file changed, 60 insertions(+)
>>
>> diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c
>> index 7f8c995..5105bf9 100644
>> --- a/extensions/libxt_mark.c
>> +++ b/extensions/libxt_mark.c
>> @@ -102,6 +102,64 @@ mark_save(const void *ip, const struct xt_entry_match *match)
>>       print_mark(info->mark, info->mask);
>>  }
>>
>> +static void
>> +print_mark_xlate(struct xt_buf *buf,
>> +              unsigned int mark, unsigned int mask)
>> +{
>> +        if (mask != 0xffffffffU)
>> +                xt_buf_add(buf, " 0x%x/0x%x", mark, mask);
>
> In nftables this should be translated to &.
>

Do you mean this?

if (mask & 0xffffffffU)

>> +        else
>> +                xt_buf_add(buf, " 0x%x", mark);
>> +}
>> +
>> +static void
>> +mark_mt_xlate_print(const struct xt_entry_match *match,
>> +                 struct xt_buf *buf, int numeric)
>> +{
>> +     const struct xt_mark_mtinfo1 *info = (const void *)match->data;
>> +
>> +     if (info->invert)
>                          ^^^^^^
> There is a tab that is not needed there. Update your editor
> configuration to highlight unnecessary spaces before line break,
>

Done.

>> +             xt_buf_add(buf, " !");
>> +     print_mark_xlate(buf, info->mark, info->mask);
>> +}
>> +
>> +static int
>> +mark_mt_xlate(const struct xt_entry_match *match,
>> +           struct xt_buf *buf, int numeric)
>> +{
>> +     const struct xt_mark_mtinfo1 *info = (const void *)match->data;
>> +
>> +        xt_buf_add(buf, "ct mark %s", info->invert ? " !" : "");
>
> Invert in nft is '!='.
>
> Please, make sure that the suggested translation actually works in
> nft.
>
> But overall this looks good like a good start.

Thank you. I'll be sending version 2.

Re: [PATCH] extensions: libxt_mark: Add translation to nft

[Pablo Neira Ayuso]

Hi Shivani,

On Sat, Dec 05, 2015 at 06:49:36PM +0530, Shivani Bhardwaj wrote:
> Add translation of the metainformation mark to nft.
> 
> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
> ---
>  extensions/libxt_mark.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 60 insertions(+)
> 
> diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c
> index 7f8c995..5105bf9 100644
> --- a/extensions/libxt_mark.c
> +++ b/extensions/libxt_mark.c
> @@ -102,6 +102,64 @@ mark_save(const void *ip, const struct xt_entry_match *match)
>  	print_mark(info->mark, info->mask);
>  }
>  
> +static void
> +print_mark_xlate(struct xt_buf *buf,
> +		 unsigned int mark, unsigned int mask)
> +{
> +        if (mask != 0xffffffffU)
> +                xt_buf_add(buf, " 0x%x/0x%x", mark, mask);

In nftables this should be translated to &.

> +        else
> +                xt_buf_add(buf, " 0x%x", mark);
> +}
> +
> +static void
> +mark_mt_xlate_print(const struct xt_entry_match *match,
> +		    struct xt_buf *buf, int numeric)
> +{
> +	const struct xt_mark_mtinfo1 *info = (const void *)match->data;
> +
> +	if (info->invert)      
                         ^^^^^^
There is a tab that is not needed there. Update your editor
configuration to highlight unnecessary spaces before line break,

> +		xt_buf_add(buf, " !");
> +	print_mark_xlate(buf, info->mark, info->mask);
> +}
> +
> +static int
> +mark_mt_xlate(const struct xt_entry_match *match,
> +	      struct xt_buf *buf, int numeric)
> +{
> +	const struct xt_mark_mtinfo1 *info = (const void *)match->data;
> +
> +        xt_buf_add(buf, "ct mark %s", info->invert ? " !" : "");

Invert in nft is '!='.

Please, make sure that the suggested translation actually works in
nft.

But overall this looks good like a good start.

[PATCH] extensions: libxt_mark: Add translation to nft

[Shivani Bhardwaj]

Add translation of the metainformation mark to nft.

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libxt_mark.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/extensions/libxt_mark.c b/extensions/libxt_mark.c
index 7f8c995..5105bf9 100644
--- a/extensions/libxt_mark.c
+++ b/extensions/libxt_mark.c
@@ -102,6 +102,64 @@ mark_save(const void *ip, const struct xt_entry_match *match)
 	print_mark(info->mark, info->mask);
 }
 
+static void
+print_mark_xlate(struct xt_buf *buf,
+		 unsigned int mark, unsigned int mask)
+{
+        if (mask != 0xffffffffU)
+                xt_buf_add(buf, " 0x%x/0x%x", mark, mask);
+        else
+                xt_buf_add(buf, " 0x%x", mark);
+}
+
+static void
+mark_mt_xlate_print(const struct xt_entry_match *match,
+		    struct xt_buf *buf, int numeric)
+{
+	const struct xt_mark_mtinfo1 *info = (const void *)match->data;
+
+	if (info->invert)      
+		xt_buf_add(buf, " !");
+	print_mark_xlate(buf, info->mark, info->mask);
+}
+
+static int
+mark_mt_xlate(const struct xt_entry_match *match,
+	      struct xt_buf *buf, int numeric)
+{
+	const struct xt_mark_mtinfo1 *info = (const void *)match->data;
+
+        xt_buf_add(buf, "ct mark %s", info->invert ? " !" : "");
+        print_mark_xlate(buf, info->mark, info->mask);
+        xt_buf_add(buf, " ");
+
+        return 1;
+}
+
+static void
+mark_xlate_print(const struct xt_entry_match *match,
+		 struct xt_buf *buf, int numeric)
+{
+       const struct xt_mark_info *info = (const void *)match->data;
+
+        if (info->invert)
+                xt_buf_add(buf, " !");
+        print_mark_xlate(buf, info->mark, info->mask);
+}
+
+static int
+mark_xlate(const struct xt_entry_match *match,
+	   struct xt_buf *buf, int numeric)
+{
+	const struct xt_mark_info *info = (const void *)match->data;
+
+	xt_buf_add(buf, "ct mark %s", info->invert ? " !" : "");
+	print_mark_xlate(buf, info->mark, info->mask);
+	xt_buf_add(buf, " ");
+
+	return 1;
+}
+
 static struct xtables_match mark_mt_reg[] = {
 	{
 		.family        = NFPROTO_UNSPEC,
@@ -115,6 +173,7 @@ static struct xtables_match mark_mt_reg[] = {
 		.save          = mark_save,
 		.x6_parse      = mark_parse,
 		.x6_options    = mark_mt_opts,
+		.xlate	       = mark_xlate,
 	},
 	{
 		.version       = XTABLES_VERSION,
@@ -128,6 +187,7 @@ static struct xtables_match mark_mt_reg[] = {
 		.save          = mark_mt_save,
 		.x6_parse      = mark_mt_parse,
 		.x6_options    = mark_mt_opts,
+		.xlate         = mark_mt_xlate,
 	},
 };
 
-- 
1.9.1