nft: native mark matching support

Use meta mark + bitwise + cmp instead of nft_compat mark match.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 5b13b29c98445ab3154a624c43c9ff16217de055..54a9118016398968b15d98586f0718243044b7ff 100644 (file)
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -24,6 +24,7 @@
 #include <linux/netfilter/xt_comment.h>
 #include <linux/netfilter/xt_limit.h>
 #include <linux/netfilter/xt_NFLOG.h>
+#include <linux/netfilter/xt_mark.h>
 
 #include <libmnl/libmnl.h>
 #include <libnftnl/rule.h>
@@ -261,6 +262,38 @@ static void parse_ifname(const char *name, unsigned int len, char *dst, unsigned
                memset(mask, 0xff, len - 2);
 }
 
+static struct xtables_match *
+nft_create_match(struct nft_xt_ctx *ctx,
+                struct iptables_command_state *cs,
+                const char *name);
+
+static int parse_meta_mark(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+{
+       struct xt_mark_mtinfo1 *mark;
+       struct xtables_match *match;
+       uint32_t value;
+
+       match = nft_create_match(ctx, ctx->cs, "mark");
+       if (!match)
+               return -1;
+
+       mark = (void*)match->m->data;
+
+       if (nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP) == NFT_CMP_NEQ)
+               mark->invert = 1;
+
+       value = nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_DATA);
+       mark->mark = value;
+       if (ctx->flags & NFT_XT_CTX_BITWISE) {
+               memcpy(&mark->mask, &ctx->bitwise.mask, sizeof(mark->mask));
+               ctx->flags &= ~NFT_XT_CTX_BITWISE;
+       } else {
+               mark->mask = 0xffffffff;
+       }
+
+       return 0;
+}
+
 int parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e, uint8_t key,
               char *iniface, unsigned char *iniface_mask,
               char *outiface, unsigned char *outiface_mask, uint8_t *invflags)
@@ -304,6 +337,9 @@ int parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e, uint8_t key,
 
                parse_ifname(ifname, len, outiface, outiface_mask);
                break;
+       case NFT_META_MARK:
+               parse_meta_mark(ctx, e);
+               break;
        default:
                return -1;
        }

diff --git a/iptables/nft.c b/iptables/nft.c
index 6883662fa28d28ea10a7e6598ee0018e7f29eebd..a629aeff98b024e974a53803ffa6ce99be70e4e5 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -40,6 +40,7 @@
 
 #include <linux/netfilter/xt_limit.h>
 #include <linux/netfilter/xt_NFLOG.h>
+#include <linux/netfilter/xt_mark.h>
 
 #include <libmnl/libmnl.h>
 #include <libnftnl/gen.h>
@@ -1406,6 +1407,26 @@ static int add_nft_tcp(struct nftnl_rule *r, struct xt_entry_match *m)
                              tcp->dpts, tcp->invflags & XT_TCP_INV_DSTPT);
 }
 
+static int add_nft_mark(struct nft_handle *h, struct nftnl_rule *r,
+                       struct xt_entry_match *m)
+{
+       struct xt_mark_mtinfo1 *mark = (void *)m->data;
+       int op;
+
+       add_meta(r, NFT_META_MARK);
+       if (mark->mask != 0xffffffff)
+               add_bitwise(r, (uint8_t *)&mark->mask, sizeof(uint32_t));
+
+       if (mark->invert)
+               op = NFT_CMP_NEQ;
+       else
+               op = NFT_CMP_EQ;
+
+       add_cmp_u32(r, mark->mark, op);
+
+       return 0;
+}
+
 int add_match(struct nft_handle *h,
              struct nftnl_rule *r, struct xt_entry_match *m)
 {
@@ -1420,6 +1441,8 @@ int add_match(struct nft_handle *h,
                return add_nft_udp(r, m);
        else if (!strcmp(m->u.user.name, "tcp"))
                return add_nft_tcp(r, m);
+       else if (!strcmp(m->u.user.name, "mark"))
+               return add_nft_mark(h, r, m);
 
        expr = nftnl_expr_alloc("match");
        if (expr == NULL)