Add translation for match tos to nftables.
Examples:
$ sudo iptables-translate -A INPUT -m tos --tos 0x02 -j ACCEPT
nft add rule ip filter INPUT ip tos 0x02 counter accept
$ sudo iptables-translate -A INPUT -m tos --tos 0x02/0x04 -j ACCEPT
nft add rule ip filter INPUT ip tos and 0x02 == 0x04 counter accept
$ sudo iptables-translate -A INPUT -m tos ! --tos 0x02/0x04 -j ACCEPT
nft add rule ip filter INPUT ip tos and 0x02 != 0x04 counter accept
Details:
This patch was sent by Ana, Shivani modified it as per the current
nftables structure, applied it to the latest branch and tested it.
Signed-off-by: Shivani Bhardwaj <shivanib134@xxxxxxxxx>
Signed-off-by: Ana Rey <anarey@xxxxxxxxx>
---
extensions/libxt_tos.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/extensions/libxt_tos.c b/extensions/libxt_tos.c
index 81c096f..577e9cb 100644
--- a/extensions/libxt_tos.c
+++ b/extensions/libxt_tos.c
@@ -121,6 +121,23 @@ static void tos_mt_save(const void *ip, const struct xt_entry_match *match)
printf(" --tos 0x%02x/0x%02x", info->tos_value, info->tos_mask);
}
+static int tos_mt_xlate(const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ const struct xt_tos_match_info *info = (const void *)match->data;
+
+ xt_xlate_add(xl, "ip tos ");
+
+ if (info->tos_mask == 0xff)
+ xt_xlate_add(xl, "%s0x%02x ", info->invert ? "!= " : "",
+ info->tos_value);
+ else
+ xt_xlate_add(xl, "and 0x%02x %s 0x%02x ", info->tos_value,
+ info->invert ? "!=" : "==", info->tos_mask);
+
+ return 1;
+}
+
static struct xtables_match tos_mt_reg[] = {
{
.version = XTABLES_VERSION,
@@ -147,6 +164,7 @@ static struct xtables_match tos_mt_reg[] = {
.save = tos_mt_save,
.x6_parse = tos_mt_parse,
.x6_options = tos_mt_opts,
+ .xlate = tos_mt_xlate,
},
};
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
