[PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype

[PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype

[Florian Westphal]

low hanging fruit: use native meta+cmp instead of libxt_pkttype.
First patch adds dissection, second patch switches to native expression.

Last patch adds support for 'otherhost' mnemonic, useless for iptables
but useful for ebtables.

[PATCH iptables-nft 1/3] nft: support dissection of meta pkktype mode

[Florian Westphal]

Makes iptables-nft-save dump 'nft meta pkttype' rules.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 iptables/nft-shared.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 74e19ccad226..79c93fe82c60 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -25,6 +25,7 @@
 #include <linux/netfilter/xt_limit.h>
 #include <linux/netfilter/xt_NFLOG.h>
 #include <linux/netfilter/xt_mark.h>
+#include <linux/netfilter/xt_pkttype.h>
 
 #include <libmnl/libmnl.h>
 #include <libnftnl/rule.h>
@@ -323,6 +324,27 @@ static int parse_meta_mark(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
 	return 0;
 }
 
+static int parse_meta_pkttype(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+{
+	struct xt_pkttype_info *pkttype;
+	struct xtables_match *match;
+	uint8_t value;
+
+	match = nft_create_match(ctx, ctx->cs, "pkttype");
+	if (!match)
+		return -1;
+
+	pkttype = (void*)match->m->data;
+
+	if (nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP) == NFT_CMP_NEQ)
+		pkttype->invert = 1;
+
+	value = nftnl_expr_get_u8(e, NFTNL_EXPR_CMP_DATA);
+	pkttype->pkttype = value;
+
+	return 0;
+}
+
 int parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e, uint8_t key,
 	       char *iniface, unsigned char *iniface_mask,
 	       char *outiface, unsigned char *outiface_mask, uint8_t *invflags)
@@ -369,6 +391,9 @@ int parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e, uint8_t key,
 	case NFT_META_MARK:
 		parse_meta_mark(ctx, e);
 		break;
+	case NFT_META_PKTTYPE:
+		parse_meta_pkttype(ctx, e);
+		break;
 	default:
 		return -1;
 	}
-- 
2.35.1

[PATCH iptables-nft 2/3] nft: prefer native 'meta pkttype' instead of xt match

[Florian Westphal]

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 iptables/nft.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/iptables/nft.c b/iptables/nft.c
index ee003511ab7f..f122075db2b2 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -41,6 +41,7 @@
 #include <linux/netfilter/xt_limit.h>
 #include <linux/netfilter/xt_NFLOG.h>
 #include <linux/netfilter/xt_mark.h>
+#include <linux/netfilter/xt_pkttype.h>
 
 #include <libmnl/libmnl.h>
 #include <libnftnl/gen.h>
@@ -1445,6 +1446,25 @@ static int add_nft_mark(struct nft_handle *h, struct nftnl_rule *r,
 	return 0;
 }
 
+static int add_nft_pkttype(struct nft_handle *h, struct nftnl_rule *r,
+			   struct xt_entry_match *m)
+{
+	struct xt_pkttype_info *pkti = (void *)m->data;
+	uint8_t reg;
+	int op;
+
+	add_meta(h, r, NFT_META_PKTTYPE, &reg);
+
+	if (pkti->invert)
+		op = NFT_CMP_NEQ;
+	else
+		op = NFT_CMP_EQ;
+
+	add_cmp_u8(r, pkti->pkttype, op, reg);
+
+	return 0;
+}
+
 int add_match(struct nft_handle *h,
 	      struct nftnl_rule *r, struct xt_entry_match *m)
 {
@@ -1461,6 +1481,8 @@ int add_match(struct nft_handle *h,
 		return add_nft_tcp(h, r, m);
 	else if (!strcmp(m->u.user.name, "mark"))
 		return add_nft_mark(h, r, m);
+	else if (!strcmp(m->u.user.name, "pkttype"))
+		return add_nft_pkttype(h, r, m);
 
 	expr = nftnl_expr_alloc("match");
 	if (expr == NULL)
-- 
2.35.1

[PATCH iptables-nft 3/3] extensions: libxt_pkttype: support otherhost

[Florian Westphal]

Makes no sense for iptables/ip6tables but it does make sense for ebtables.
Classic ebtables uses libebt_pkttype which isn't compatible, but
iptables-nft can use the libxt_pkttype version when printing native
'meta pkttype'.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 extensions/libxt_pkttype.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/libxt_pkttype.c b/extensions/libxt_pkttype.c
index bf6f5b960662..a76310b053b4 100644
--- a/extensions/libxt_pkttype.c
+++ b/extensions/libxt_pkttype.c
@@ -30,8 +30,8 @@ static const struct pkttypes supported_types[] = {
 	{"unicast", PACKET_HOST, 1, "to us"},
 	{"broadcast", PACKET_BROADCAST, 1, "to all"},
 	{"multicast", PACKET_MULTICAST, 1, "to group"},
-/*
 	{"otherhost", PACKET_OTHERHOST, 1, "to someone else"},
+/*
 	{"outgoing", PACKET_OUTGOING, 1, "outgoing of any type"},
 */
 	/* aliases */
-- 
2.35.1

Re: [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype

[Phil Sutter]

On Thu, Sep 08, 2022 at 05:12:39PM +0200, Florian Westphal wrote:
> low hanging fruit: use native meta+cmp instead of libxt_pkttype.
> First patch adds dissection, second patch switches to native expression.
> 
> Last patch adds support for 'otherhost' mnemonic, useless for iptables
> but useful for ebtables.

Reviewed-by: Phil Sutter <phil@nwl.cc>

Re: [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> On Thu, Sep 08, 2022 at 05:12:39PM +0200, Florian Westphal wrote:
> > low hanging fruit: use native meta+cmp instead of libxt_pkttype.
> > First patch adds dissection, second patch switches to native expression.
> > 
> > Last patch adds support for 'otherhost' mnemonic, useless for iptables
> > but useful for ebtables.
> 
> Reviewed-by: Phil Sutter <phil@nwl.cc>

Thanks for the quick review, applied.