On Thu, Mar 07, 2024 at 03:05:28PM +0100, Florian Westphal wrote:
> Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
> ---
> extensions/libxt_TPROXY.c | 59 ++++++++++++++++++++++++++++++++++
> extensions/libxt_TPROXY.txlate | 17 ++++++++++
> 2 files changed, 76 insertions(+)
> create mode 100644 extensions/libxt_TPROXY.txlate
>
> diff --git a/extensions/libxt_TPROXY.c b/extensions/libxt_TPROXY.c
> index d13ec85f92d0..4d2d7961ca2c 100644
> --- a/extensions/libxt_TPROXY.c
> +++ b/extensions/libxt_TPROXY.c
> @@ -147,6 +147,62 @@ static void tproxy_tg1_parse(struct xt_option_call *cb)
> }
> }
>
> +static int tproxy_tg_xlate(struct xt_xlate *xl,
> + const struct xt_tproxy_target_info_v1 *info)
> +{
> + int family = xt_xlate_get_family(xl);
> + uint32_t mask = info->mark_mask;
> + bool port_mandatory = false;
> + char buf[INET6_ADDRSTRLEN];
> +
> + xt_xlate_add(xl, "tproxy to");
> +
> + inet_ntop(family, &info->laddr, buf, sizeof(buf));
> +
> + if (family == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(&info->laddr.in6))
> + xt_xlate_add(xl, "[%s]", buf);
Could you please add a testcase involving an IPv6 address? Just so we
exercise this code path.
> + else if (family == AF_INET && info->laddr.ip)
> + xt_xlate_add(xl, "%s", buf);
> + else
> + port_mandatory = true;
> +
> + if (port_mandatory)
> + xt_xlate_add(xl, " :%d", ntohs(info->lport));
> + else if (info->lport)
> + xt_xlate_add(xl, ":%d", ntohs(info->lport));
> +
> + /* xt_TPROXY.c does: skb->mark = (skb->mark & ~mark_mask) ^ mark_value */
> + if (mask == 0xffffffff)
> + xt_xlate_add(xl, "meta mark set 0x%x", info->mark_value);
> + else if (mask || info->mark_value)
> + xt_xlate_add(xl, "meta mark set meta mark & 0x%x or 0x%x",
> + ~mask, info->mark_value);
Shouldn't this be 'xor' instead of 'or' in translated output? I wanted
to suggest "meta mark set meta mark and not <mask> xor <mark_value>",
but it seems nft supports only boolean negations.
Thanks, Phil
