comment: Add translation to nft

Add translation for match comment to nftables.
This patch also adds the relevant infrastructure for carrying out
the translation.

Example:

$ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block"
nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\"

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_comment.c b/extensions/libxt_comment.c
index 6ed2ff9b3c2645662f761d1aacfeae7cdb0add79..3fcb8b46b6c6c4243c2fee5ba17e56d2a806e1c5 100644 (file)
--- a/extensions/libxt_comment.c
+++ b/extensions/libxt_comment.c
@@ -48,6 +48,18 @@ comment_save(const void *ip, const struct xt_entry_match *match)
        xtables_save_string(commentinfo->comment);
 }
 
+static int
+comment_xlate(const struct xt_entry_match *match,
+             struct xt_xlate *xl, int numeric)
+{
+       struct xt_comment_info *commentinfo = (void *)match->data;
+
+       commentinfo->comment[XT_MAX_COMMENT_LEN - 1] = '\0';
+       xt_xlate_add_comment(xl, commentinfo->comment);
+
+       return 1;
+}
+
 static struct xtables_match comment_match = {
        .family         = NFPROTO_UNSPEC,
        .name           = "comment",
@@ -59,6 +71,7 @@ static struct xtables_match comment_match = {
        .save           = comment_save,
        .x6_parse       = xtables_option_parse,
        .x6_options     = comment_opts,
+       .xlate          = comment_xlate,
 };
 
 void _init(void)

diff --git a/include/xtables.h b/include/xtables.h
index 6fd3bdfc1548d75e8dc7844db5e00063c352878e..e219c9f9947f2333fb050d5c3aa021cc5cb03ac1 100644 (file)
--- a/include/xtables.h
+++ b/include/xtables.h
@@ -574,6 +574,7 @@ struct xt_xlate *xt_xlate_alloc(int size);
 void xt_xlate_free(struct xt_xlate *xl);
 void xt_xlate_add(struct xt_xlate *xl, const char *fmt, ...);
 void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment);
+const char *xt_xlate_get_comment(struct xt_xlate *xl);
 const char *xt_xlate_get(struct xt_xlate *xl);
 
 #ifdef XTABLES_INTERNAL

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 5e2857d38c322a0f0f067b5462d12e597e67cd62..cf985b7327af82d463f8e45aaa10b232e914998b 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -432,6 +432,7 @@ static void nft_ipv4_save_counters(const void *data)
 static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
 {
        const struct iptables_command_state *cs = data;
+       const char *comment;
        int ret;
 
        if (cs->fw.ip.iniface[0] != '\0') {
@@ -484,6 +485,10 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
        /* Always add counters per rule, as in iptables */
        xt_xlate_add(xl, "counter ");
 
+       comment = xt_xlate_get_comment(xl);
+       if (comment)
+               xt_xlate_add(xl, "comment \\\"%s\\\" ", comment);
+
        ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
 
        return ret;

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 0ee7957520b53c2d1ccb1df899740b498e24f3b4..92d37a022bf0035f8f9c20112e4118ae3af82f87 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -392,6 +392,7 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr,
 static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
 {
        const struct iptables_command_state *cs = data;
+       const char *comment;
        int ret;
 
        if (cs->fw6.ipv6.iniface[0] != '\0') {
@@ -435,6 +436,10 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
        /* Always add counters per rule, as in iptables */
        xt_xlate_add(xl, "counter ");
 
+       comment = xt_xlate_get_comment(xl);
+       if (comment)
+               xt_xlate_add(xl, "comment \\\"%s\\\" ", comment);
+
        ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl);
 
        return ret;

diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index c4b86f51da3819d5ff76e729e8741c14ebe03935..fe24caa2d651c2f63c010ce16c652558a3a9ded8 100644 (file)
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -2045,6 +2045,11 @@ void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment)
        xl->comment[NFT_USERDATA_MAXLEN - 1] = '\0';
 }
 
+const char *xt_xlate_get_comment(struct xt_xlate *xl)
+{
+       return xl->comment[0] ? xl->comment : NULL;
+}
+
 const char *xt_xlate_get(struct xt_xlate *xl)
 {
        return xl->buf.data;