iptables-compat: use nft built-in comments support

After this patch, iptables-compat uses nft built-in comments support
instead of comment match.

This change simplifies the treatment of comments in nft after load a
rule set through iptables-compat-restore.

Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index cf985b7327af82d463f8e45aaa10b232e914998b..814ca14ddcca9158deaa0709b311adbca21f6898 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -31,6 +31,7 @@ static int nft_ipv4_add(struct nftnl_rule *r, void *data)
        struct iptables_command_state *cs = data;
        struct xtables_rule_match *matchp;
        uint32_t op;
+       int ret;
 
        if (cs->fw.ip.iniface[0] != '\0') {
                op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_IN);
@@ -74,8 +75,16 @@ static int nft_ipv4_add(struct nftnl_rule *r, void *data)
        add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags);
 
        for (matchp = cs->matches; matchp; matchp = matchp->next) {
-               if (add_match(r, matchp->match->m) < 0)
-                       break;
+               /* Use nft built-in comments support instead of comment match */
+               if (strcmp(matchp->match->name, "comment") == 0) {
+                       ret = add_comment(r, (char *)matchp->match->m->data);
+                       if (ret < 0)
+                               return ret;
+               } else {
+                       ret = add_match(r, matchp->match->m);
+                       if (ret < 0)
+                               return ret;
+               }
        }
 
        /* Counters need to me added before the target, otherwise they are

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 115011893305c92e9e941db8784be20cc235cd14..bfbf8dff218c8d619b9648b28adc12cf92247d0e 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -30,6 +30,7 @@ static int nft_ipv6_add(struct nftnl_rule *r, void *data)
        struct iptables_command_state *cs = data;
        struct xtables_rule_match *matchp;
        uint32_t op;
+       int ret;
 
        if (cs->fw6.ipv6.iniface[0] != '\0') {
                op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN);
@@ -62,8 +63,16 @@ static int nft_ipv6_add(struct nftnl_rule *r, void *data)
        add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags);
 
        for (matchp = cs->matches; matchp; matchp = matchp->next) {
-               if (add_match(r, matchp->match->m) < 0)
-                       break;
+               /* Use nft built-in comments support instead of comment match */
+               if (strcmp(matchp->match->name, "comment") == 0) {
+                       ret = add_comment(r, (char *)matchp->match->m->data);
+                       if (ret < 0)
+                               return ret;
+               } else {
+                       ret = add_match(r, matchp->match->m);
+                       if (ret < 0)
+                               return ret;
+               }
        }
 
        /* Counters need to me added before the target, otherwise they are

diff --git a/iptables/nft.c b/iptables/nft.c
index 68b4da3830b6cf5b8f04423b707a15c98a9afb76..c81bb0e60c01a4ccf70636bb0dfd3abe30ed18fd 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -43,6 +43,7 @@
 #include <libnftnl/rule.h>
 #include <libnftnl/expr.h>
 #include <libnftnl/set.h>
+#include <libnftnl/udata.h>
 
 #include <netinet/in.h>        /* inet_ntoa */
 #include <arpa/inet.h>
@@ -1007,6 +1008,31 @@ int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes)
        return 0;
 }
 
+enum udata_type {
+       UDATA_TYPE_COMMENT,
+       __UDATA_TYPE_MAX,
+};
+#define UDATA_TYPE_MAX (__UDATA_TYPE_MAX - 1)
+
+int add_comment(struct nftnl_rule *r, const char *comment)
+{
+       struct nftnl_udata_buf *udata;
+
+       udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
+       if (!udata)
+               return -ENOMEM;
+
+       if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comment))
+               return -ENOMEM;
+       nftnl_rule_set_data(r, NFTNL_RULE_USERDATA,
+                           nftnl_udata_buf_data(udata),
+                           nftnl_udata_buf_len(udata));
+
+       nftnl_udata_buf_free(udata);
+
+       return 0;
+}
+
 void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv)
 {
        nftnl_rule_set_u32(r, NFTNL_RULE_COMPAT_PROTO, proto);

diff --git a/iptables/nft.h b/iptables/nft.h
index 281e1c69e9141c9e8632113641cd64ca60d4028c..9e02eeb14231824728e84bffb12e651149816f40 100644 (file)
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -104,6 +104,7 @@ int add_match(struct nftnl_rule *r, struct xt_entry_match *m);
 int add_target(struct nftnl_rule *r, struct xt_entry_target *t);
 int add_jumpto(struct nftnl_rule *r, const char *name, int verdict);
 int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set);
+int add_comment(struct nftnl_rule *r, const char *comment);
 
 enum nft_rule_print {
        NFT_RULE_APPEND,