From: Liping Zhang <liping.zh...@spreadtrum.com> Add translation for connlabel to nftables. For examples:
# iptables-translate -A INPUT -m connlabel --label bit40 nft add rule ip filter INPUT ct label bit40 counter # iptables-translate -A INPUT -m connlabel ! --label bit40 --set nft add rule ip filter INPUT ct label set bit40 ct label != bit40 counter Signed-off-by: Liping Zhang <liping.zh...@spreadtrum.com> --- extensions/libxt_connlabel.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c index 1f83095..e9aeca8 100644 --- a/extensions/libxt_connlabel.c +++ b/extensions/libxt_connlabel.c @@ -118,6 +118,27 @@ connlabel_mt_save(const void *ip, const struct xt_entry_match *match) connlabel_mt_print_op(info, "--"); } +static int +connlabel_mt_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_connlabel_mtinfo *info = (const void *)match->data; + const char *name = connlabel_get_name(info->bit); + + if (name == NULL) + return 0; + + if (info->options & XT_CONNLABEL_OP_SET) + xt_xlate_add(xl, "ct label set %s ", name); + + xt_xlate_add(xl, "ct label "); + if (info->options & XT_CONNLABEL_OP_INVERT) + xt_xlate_add(xl, "!= "); + xt_xlate_add(xl, "%s", name); + + return 1; +} + static struct xtables_match connlabel_mt_reg = { .family = NFPROTO_UNSPEC, .name = "connlabel", @@ -129,6 +150,7 @@ static struct xtables_match connlabel_mt_reg = { .save = connlabel_mt_save, .x6_parse = connlabel_mt_parse, .x6_options = connlabel_mt_opts, + .xlate = connlabel_mt_xlate, }; void _init(void) -- 2.5.5 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html