On Wed, Mar 9, 2016 at 10:58 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> On Wed, Mar 09, 2016 at 10:42:13PM +0530, Bhumika Goyal wrote:
>> On Wed, Mar 9, 2016 at 10:22 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
>> > On Wed, Mar 09, 2016 at 09:28:53PM +0530, Bhumika Goyal wrote:
>> >> Add translation for target CONNMARK to nftables.
>> >>
>> >> Examples:
>> >>
>> >> $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 80 -j CONNMARK --save-mark
>> >> nft add rule ip mangle PREROUTING tcp dport 80 counter mark save nfmask 0xffffffff ctmask 0xffffffff
>> >>
>> >> $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 80 -j CONNMARK --restore-mark --mask 12
>> >> nft add rule ip mangle PREROUTING tcp dport 80 counter mark restore nfmask 0xc ctmask 0xc
>> >>
>> >> $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 22 -j CONNMARK --set-mark 2
>> >> nft add rule ip mangle PREROUTING tcp dport 22 counter mark set 0x2/0xffffffff
>> >>
>> >> Signed-off-by: Bhumika Goyal <bhumirks@xxxxxxxxx>
>> >> ---
>> >> extensions/libxt_CONNMARK.c | 28 ++++++++++++++++++++++++++++
>> >> 1 file changed, 28 insertions(+)
>> >>
>> >> diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
>> >> index 42cf207..e2dbf8d 100644
>> >> --- a/extensions/libxt_CONNMARK.c
>> >> +++ b/extensions/libxt_CONNMARK.c
>> >> @@ -347,6 +347,32 @@ connmark_tg_save(const void *ip, const struct xt_entry_target *target)
>> >> }
>> >> }
>> >>
>> >> +static int
>> >> +connmark_tg_xlate(const struct xt_entry_target *target,
>> >> + struct xt_xlate *xl, int numeric)
>> >> +{
>> >> + const struct xt_connmark_tginfo1 *info = (const void *)target->data;
>> >> +
>> >> + switch (info->mode) {
>> >> + case XT_CONNMARK_SET:
>> >> + xt_xlate_add(xl, "mark set 0x%x/0x%x", info->ctmark, info->ctmask);
>> >> + break;
>> >> + case XT_CONNMARK_SAVE:
>> >> + xt_xlate_add(xl,"mark save nfmask 0x%x ctmask 0x%x",
>> >> + info->nfmask, info->ctmask);
>> >> + break;
>> >> + case XT_CONNMARK_RESTORE:
>> >> + xt_xlate_add(xl,"mark restore nfmask 0x%x ctmask 0x%x",
>> >> + info->nfmask, info->ctmask);
>> >
>> > This translation is not correct.
>> >
>>
>> Thanks for the feedback. Could you please tell me the mistake as I am
>> not able to figure out my mistake?
>
> You have to test your translations, to make sure they work fine with
> nft:
>
> # nft add rule filter PREROUTING nft add rule ip mangle PREROUTING tcp dport 80 counter mark restore nfmask 0xc ctmask 0xc
> <cmdline>:1:32-34: Error: syntax error, unexpected add
> add rule filter PREROUTING nft add rule ip mangle PREROUTING tcp dport
> 80 counter mark restore nfmask 0xc ctmask 0xc
> ^^^
>
> This syntax is not correct. Please, have a look at the wiki and
> investigate how to translate this. Thanks.
Ok. I will read more on the wiki and then try to correct it.
Thanks,
Bhumika
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
