On Wed, Mar 09, 2016 at 09:28:53PM +0530, Bhumika Goyal wrote:
> Add translation for target CONNMARK to nftables.
>
> Examples:
>
> $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 80 -j CONNMARK --save-mark
> nft add rule ip mangle PREROUTING tcp dport 80 counter mark save nfmask 0xffffffff ctmask 0xffffffff
>
> $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 80 -j CONNMARK --restore-mark --mask 12
> nft add rule ip mangle PREROUTING tcp dport 80 counter mark restore nfmask 0xc ctmask 0xc
>
> $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 22 -j CONNMARK --set-mark 2
> nft add rule ip mangle PREROUTING tcp dport 22 counter mark set 0x2/0xffffffff
>
> Signed-off-by: Bhumika Goyal <bhumirks@xxxxxxxxx>
> ---
> extensions/libxt_CONNMARK.c | 28 ++++++++++++++++++++++++++++
> 1 file changed, 28 insertions(+)
>
> diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
> index 42cf207..e2dbf8d 100644
> --- a/extensions/libxt_CONNMARK.c
> +++ b/extensions/libxt_CONNMARK.c
> @@ -347,6 +347,32 @@ connmark_tg_save(const void *ip, const struct xt_entry_target *target)
> }
> }
>
> +static int
> +connmark_tg_xlate(const struct xt_entry_target *target,
> + struct xt_xlate *xl, int numeric)
> +{
> + const struct xt_connmark_tginfo1 *info = (const void *)target->data;
> +
> + switch (info->mode) {
> + case XT_CONNMARK_SET:
> + xt_xlate_add(xl, "mark set 0x%x/0x%x", info->ctmark, info->ctmask);
> + break;
> + case XT_CONNMARK_SAVE:
> + xt_xlate_add(xl,"mark save nfmask 0x%x ctmask 0x%x",
> + info->nfmask, info->ctmask);
> + break;
> + case XT_CONNMARK_RESTORE:
> + xt_xlate_add(xl,"mark restore nfmask 0x%x ctmask 0x%x",
> + info->nfmask, info->ctmask);
This translation is not correct.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
