extensions: libxt_cgroup: Add translation to nft

Add translation for cgroup to nft. Path parameter not supported in nft
yet.

Examples:

$ sudo iptables-translate -t filter -A INPUT -m cgroup --cgroup 0 -j ACCEPT
nft add rule ip filter INPUT meta cgroup 0 counter accept

$ sudo iptables-translate -t filter -A INPUT -m cgroup ! --cgroup 0 -j ACCEPT
nft add rule ip filter INPUT meta cgroup != 0 counter accept

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_cgroup.c b/extensions/libxt_cgroup.c
index 3be42ad530cd404354bee2eba1f69406089ea519..11918151ea268aea222b2f5dcb152b68631f9d17 100644 (file)
--- a/extensions/libxt_cgroup.c
+++ b/extensions/libxt_cgroup.c
@@ -121,6 +121,32 @@ static void cgroup_save_v1(const void *ip, const struct xt_entry_match *match)
                       info->classid);
 }
 
+static int cgroup_xlate_v0(const void *ip, const struct xt_entry_match *match,
+                          struct xt_xlate *xl, int numeric)
+{
+       const struct xt_cgroup_info_v0 *info = (void *)match->data;
+
+       xt_xlate_add(xl, "meta cgroup %s%u ", info->invert ? "!= " : "",
+                    info->id);
+       return 1;
+}
+
+static int cgroup_xlate_v1(const void *ip, const struct xt_entry_match *match,
+                          struct xt_xlate *xl, int numeric)
+{
+       const struct xt_cgroup_info_v1 *info = (void *)match->data;
+
+       if (info->has_path)
+               return 0;
+
+       if (info->has_classid)
+               xt_xlate_add(xl, "meta cgroup %s%u ",
+                            info->invert_classid ? "!= " : "",
+                            info->classid);
+
+       return 1;
+}
+
 static struct xtables_match cgroup_match[] = {
        {
                .family         = NFPROTO_UNSPEC,
@@ -134,6 +160,7 @@ static struct xtables_match cgroup_match[] = {
                .save           = cgroup_save_v0,
                .x6_parse       = cgroup_parse_v0,
                .x6_options     = cgroup_opts_v0,
+               .xlate          = cgroup_xlate_v0,
        },
        {
                .family         = NFPROTO_UNSPEC,
@@ -147,6 +174,7 @@ static struct xtables_match cgroup_match[] = {
                .save           = cgroup_save_v1,
                .x6_parse       = cgroup_parse_v1,
                .x6_options     = cgroup_opts_v1,
+               .xlate          = cgroup_xlate_v1,
        },
 };