* [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype
@ 2022-09-08 15:12 Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 1/3] nft: support dissection of meta pkktype mode Florian Westphal
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Florian Westphal @ 2022-09-08 15:12 UTC (permalink / raw)
To: netfilter-devel
low hanging fruit: use native meta+cmp instead of libxt_pkttype.
First patch adds dissection, second patch switches to native expression.
Last patch adds support for 'otherhost' mnemonic, useless for iptables
but useful for ebtables.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH iptables-nft 1/3] nft: support dissection of meta pkktype mode
2022-09-08 15:12 [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Florian Westphal
@ 2022-09-08 15:12 ` Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 2/3] nft: prefer native 'meta pkttype' instead of xt match Florian Westphal
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2022-09-08 15:12 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Makes iptables-nft-save dump 'nft meta pkttype' rules.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
iptables/nft-shared.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 74e19ccad226..79c93fe82c60 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -25,6 +25,7 @@
#include <linux/netfilter/xt_limit.h>
#include <linux/netfilter/xt_NFLOG.h>
#include <linux/netfilter/xt_mark.h>
+#include <linux/netfilter/xt_pkttype.h>
#include <libmnl/libmnl.h>
#include <libnftnl/rule.h>
@@ -323,6 +324,27 @@ static int parse_meta_mark(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
return 0;
}
+static int parse_meta_pkttype(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+{
+ struct xt_pkttype_info *pkttype;
+ struct xtables_match *match;
+ uint8_t value;
+
+ match = nft_create_match(ctx, ctx->cs, "pkttype");
+ if (!match)
+ return -1;
+
+ pkttype = (void*)match->m->data;
+
+ if (nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP) == NFT_CMP_NEQ)
+ pkttype->invert = 1;
+
+ value = nftnl_expr_get_u8(e, NFTNL_EXPR_CMP_DATA);
+ pkttype->pkttype = value;
+
+ return 0;
+}
+
int parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e, uint8_t key,
char *iniface, unsigned char *iniface_mask,
char *outiface, unsigned char *outiface_mask, uint8_t *invflags)
@@ -369,6 +391,9 @@ int parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e, uint8_t key,
case NFT_META_MARK:
parse_meta_mark(ctx, e);
break;
+ case NFT_META_PKTTYPE:
+ parse_meta_pkttype(ctx, e);
+ break;
default:
return -1;
}
--
2.35.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH iptables-nft 2/3] nft: prefer native 'meta pkttype' instead of xt match
2022-09-08 15:12 [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 1/3] nft: support dissection of meta pkktype mode Florian Westphal
@ 2022-09-08 15:12 ` Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 3/3] extensions: libxt_pkttype: support otherhost Florian Westphal
2022-09-08 15:37 ` [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Phil Sutter
3 siblings, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2022-09-08 15:12 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Signed-off-by: Florian Westphal <fw@strlen.de>
---
iptables/nft.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/iptables/nft.c b/iptables/nft.c
index ee003511ab7f..f122075db2b2 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -41,6 +41,7 @@
#include <linux/netfilter/xt_limit.h>
#include <linux/netfilter/xt_NFLOG.h>
#include <linux/netfilter/xt_mark.h>
+#include <linux/netfilter/xt_pkttype.h>
#include <libmnl/libmnl.h>
#include <libnftnl/gen.h>
@@ -1445,6 +1446,25 @@ static int add_nft_mark(struct nft_handle *h, struct nftnl_rule *r,
return 0;
}
+static int add_nft_pkttype(struct nft_handle *h, struct nftnl_rule *r,
+ struct xt_entry_match *m)
+{
+ struct xt_pkttype_info *pkti = (void *)m->data;
+ uint8_t reg;
+ int op;
+
+ add_meta(h, r, NFT_META_PKTTYPE, ®);
+
+ if (pkti->invert)
+ op = NFT_CMP_NEQ;
+ else
+ op = NFT_CMP_EQ;
+
+ add_cmp_u8(r, pkti->pkttype, op, reg);
+
+ return 0;
+}
+
int add_match(struct nft_handle *h,
struct nftnl_rule *r, struct xt_entry_match *m)
{
@@ -1461,6 +1481,8 @@ int add_match(struct nft_handle *h,
return add_nft_tcp(h, r, m);
else if (!strcmp(m->u.user.name, "mark"))
return add_nft_mark(h, r, m);
+ else if (!strcmp(m->u.user.name, "pkttype"))
+ return add_nft_pkttype(h, r, m);
expr = nftnl_expr_alloc("match");
if (expr == NULL)
--
2.35.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH iptables-nft 3/3] extensions: libxt_pkttype: support otherhost
2022-09-08 15:12 [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 1/3] nft: support dissection of meta pkktype mode Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 2/3] nft: prefer native 'meta pkttype' instead of xt match Florian Westphal
@ 2022-09-08 15:12 ` Florian Westphal
2022-09-08 15:37 ` [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Phil Sutter
3 siblings, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2022-09-08 15:12 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Makes no sense for iptables/ip6tables but it does make sense for ebtables.
Classic ebtables uses libebt_pkttype which isn't compatible, but
iptables-nft can use the libxt_pkttype version when printing native
'meta pkttype'.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
extensions/libxt_pkttype.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/extensions/libxt_pkttype.c b/extensions/libxt_pkttype.c
index bf6f5b960662..a76310b053b4 100644
--- a/extensions/libxt_pkttype.c
+++ b/extensions/libxt_pkttype.c
@@ -30,8 +30,8 @@ static const struct pkttypes supported_types[] = {
{"unicast", PACKET_HOST, 1, "to us"},
{"broadcast", PACKET_BROADCAST, 1, "to all"},
{"multicast", PACKET_MULTICAST, 1, "to group"},
-/*
{"otherhost", PACKET_OTHERHOST, 1, "to someone else"},
+/*
{"outgoing", PACKET_OUTGOING, 1, "outgoing of any type"},
*/
/* aliases */
--
2.35.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype
2022-09-08 15:12 [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Florian Westphal
` (2 preceding siblings ...)
2022-09-08 15:12 ` [PATCH iptables-nft 3/3] extensions: libxt_pkttype: support otherhost Florian Westphal
@ 2022-09-08 15:37 ` Phil Sutter
2022-09-08 15:56 ` Florian Westphal
3 siblings, 1 reply; 6+ messages in thread
From: Phil Sutter @ 2022-09-08 15:37 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Thu, Sep 08, 2022 at 05:12:39PM +0200, Florian Westphal wrote:
> low hanging fruit: use native meta+cmp instead of libxt_pkttype.
> First patch adds dissection, second patch switches to native expression.
>
> Last patch adds support for 'otherhost' mnemonic, useless for iptables
> but useful for ebtables.
Reviewed-by: Phil Sutter <phil@nwl.cc>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype
2022-09-08 15:37 ` [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Phil Sutter
@ 2022-09-08 15:56 ` Florian Westphal
0 siblings, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2022-09-08 15:56 UTC (permalink / raw)
To: Phil Sutter, Florian Westphal, netfilter-devel
Phil Sutter <phil@nwl.cc> wrote:
> On Thu, Sep 08, 2022 at 05:12:39PM +0200, Florian Westphal wrote:
> > low hanging fruit: use native meta+cmp instead of libxt_pkttype.
> > First patch adds dissection, second patch switches to native expression.
> >
> > Last patch adds support for 'otherhost' mnemonic, useless for iptables
> > but useful for ebtables.
>
> Reviewed-by: Phil Sutter <phil@nwl.cc>
Thanks for the quick review, applied.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-09-08 15:56 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-08 15:12 [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 1/3] nft: support dissection of meta pkktype mode Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 2/3] nft: prefer native 'meta pkttype' instead of xt match Florian Westphal
2022-09-08 15:12 ` [PATCH iptables-nft 3/3] extensions: libxt_pkttype: support otherhost Florian Westphal
2022-09-08 15:37 ` [PATCH iptables-nft 0/3] nft: prefer meta pkttype to libxt_pkttype Phil Sutter
2022-09-08 15:56 ` Florian Westphal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.