Re: [PATCH iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Florian Westphal
Liping Zhang wrote: > From: Liping Zhang > > Add translation for connlabel to nftables. > For examples: > > # iptables-translate -A INPUT -m connlabel --label bit40 > nft add rule ip filter INPUT ct label bit40 counter > > # iptables-translate -A INPUT -m connlabel ! --label bit40 --set

Re: [PATCH nf] netfilter: nft_ct: fix unpaired nf_connlabels_get/put call

2016-07-16 Thread Florian Westphal
Liping Zhang wrote: > From: Liping Zhang > > We only get nf_connlabels if the user add ct label set expr successfully, > but we will also put nf_connlabels if the user delete ct lable get expr. > This is mismathced, and will cause ct label expr cannot work properly. > > Also, if we init somethi

Re: [PATCH iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Liping Zhang
At 2016-07-16 17:04:39, "Florian Westphal" wrote: >Liping Zhang wrote: >> >> # iptables-translate -A INPUT -m connlabel ! --label bit40 --set >> nft add rule ip filter INPUT ct label set bit40 ct label != bit40 counter > >Should probably be: > >... ct label and bit40 != bit40 ... > >!= bit40

[PATCH V2 iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Liping Zhang
From: Liping Zhang Add translation for connlabel to nftables. For examples: # iptables-translate -A INPUT -m connlabel --label bit40 nft add rule ip filter INPUT ct label bit40 counter # iptables-translate -A INPUT -m connlabel ! --label bit40 --set nft add rule ip filter INPUT ct label

Re: [PATCH V2 iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Florian Westphal
Liping Zhang wrote: > From: Liping Zhang > > Add translation for connlabel to nftables. > For examples: > > # iptables-translate -A INPUT -m connlabel --label bit40 > nft add rule ip filter INPUT ct label bit40 counter > > # iptables-translate -A INPUT -m connlabel ! --label bit40 --set

[PATCH iptables] extensions: libxt_connlabel: fix crash when connlabel.conf is empty

2016-07-16 Thread Liping Zhang
From: Liping Zhang When connlabel.conf is empty, nfct_labelmap_new will return NULL and set errno to 0. So we will miss to check this situation, and cause NULL deference in nfct_labelmap_get_bit. Input the following commands will reproduce this crash: # echo > /etc/xtables/connlabel.conf # i

Re: [PATCH iptables] extensions: libxt_connlabel: fix crash when connlabel.conf is empty

2016-07-16 Thread Florian Westphal
Liping Zhang wrote: > From: Liping Zhang > > When connlabel.conf is empty, nfct_labelmap_new will return NULL and > set errno to 0. So we will miss to check this situation, and cause NULL > deference in nfct_labelmap_get_bit. > > Input the following commands will reproduce this crash: > # ech

Re: [PATCH V2 iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Pablo Neira Ayuso
On Sat, Jul 16, 2016 at 06:42:24PM +0800, Liping Zhang wrote: > From: Liping Zhang > > Add translation for connlabel to nftables. > For examples: > > # iptables-translate -A INPUT -m connlabel --label bit40 > nft add rule ip filter INPUT ct label bit40 counter > > # iptables-translate -A

Re: [PATCH V2 iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Pablo Neira Ayuso
On Sat, Jul 16, 2016 at 06:42:24PM +0800, Liping Zhang wrote: > # iptables-translate -A INPUT -m connlabel ! --label bit40 --set > nft add rule ip filter INPUT ct label set bit40 ct label and bit40 != bit40 > counter I think this logic is inverted, I mean: nft add rule ip filter INPUT ct lab

Re: [PATCH V2 iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Pablo Neira Ayuso
On Sat, Jul 16, 2016 at 04:51:30PM +0200, Pablo Neira Ayuso wrote: > On Sat, Jul 16, 2016 at 06:42:24PM +0800, Liping Zhang wrote: > > # iptables-translate -A INPUT -m connlabel ! --label bit40 --set > > nft add rule ip filter INPUT ct label set bit40 ct label and bit40 != > > bit40 counter >

Re: [PATCH V2 iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Florian Westphal
Pablo Neira Ayuso wrote: > On Sat, Jul 16, 2016 at 06:42:24PM +0800, Liping Zhang wrote: > > # iptables-translate -A INPUT -m connlabel ! --label bit40 --set > > nft add rule ip filter INPUT ct label set bit40 ct label and bit40 != > > bit40 counter > > I think this logic is inverted, I mean

Re: [PATCH V2 iptables] extensions: libxt_connlabel: Add translation to nft

2016-07-16 Thread Florian Westphal
Pablo Neira Ayuso wrote: > On Sat, Jul 16, 2016 at 04:51:30PM +0200, Pablo Neira Ayuso wrote: > > On Sat, Jul 16, 2016 at 06:42:24PM +0800, Liping Zhang wrote: > > > # iptables-translate -A INPUT -m connlabel ! --label bit40 --set > > > nft add rule ip filter INPUT ct label set bit40 ct label