rodanber | 29 Jun 20:48 2016
Picon

[PATCH] iptables: extensions: libxt_ecn: Add translation to nft

From: Roberto García <rodanber <at> gmail.com>

Add translation of the ecn match to nftables.

Examples:
  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
  nft add rule ip filter INPUT ip ecn not-ect counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
  nft add rule ip filter INPUT ip ecn ect1 counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
  nft add rule ip filter INPUT ip ecn ect0 counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
  nft add rule ip filter INPUT ip ecn ce counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
  nft add rule ip filter INPUT ip ecn != not-ect counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
  nft add rule ip filter INPUT ip ecn != ect1 counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
  nft add rule ip filter INPUT ip ecn != ect0 counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
  nft add rule ip filter INPUT ip ecn != ce counter

Signed-off-by: Roberto García <rodanber <at> gmail.com>
(Continue reading)

Pablo M. Bermudo Garay | 29 Jun 14:33 2016
Picon

[nft PATCH 1/3 v3] include: cache ip_tables.h, ip6_tables.h, arp_tables.h and ebtables.h

From: Pablo Neira <pablo <at> netfilter.org>

The xt over nft support that comes in follow up patches need this, and update
the corresponding Makefile.am.

Based on patch from Arturo Borrero Gonzalez.

Signed-off-by: Pablo Neira Ayuso <pablo <at> netfilter.org>
---

Resubmission of xt compat support preparatory patch.

 configure.ac                               |   4 +
 include/linux/Makefile.am                  |   7 +-
 include/linux/netfilter_arp/Makefile.am    |   1 +
 include/linux/netfilter_arp/arp_tables.h   | 204 ++++++++++++++++++++++
 include/linux/netfilter_bridge/Makefile.am |   1 +
 include/linux/netfilter_bridge/ebtables.h  | 266 +++++++++++++++++++++++++++++
 include/linux/netfilter_ipv4/Makefile.am   |   1 +
 include/linux/netfilter_ipv4/ip_tables.h   | 227 ++++++++++++++++++++++++
 include/linux/netfilter_ipv6/Makefile.am   |   1 +
 include/linux/netfilter_ipv6/ip6_tables.h  | 265 ++++++++++++++++++++++++++++
 10 files changed, 976 insertions(+), 1 deletion(-)
 create mode 100644 include/linux/netfilter_arp/Makefile.am
 create mode 100644 include/linux/netfilter_arp/arp_tables.h
 create mode 100644 include/linux/netfilter_bridge/Makefile.am
 create mode 100644 include/linux/netfilter_bridge/ebtables.h
 create mode 100644 include/linux/netfilter_ipv4/Makefile.am
 create mode 100644 include/linux/netfilter_ipv4/ip_tables.h
 create mode 100644 include/linux/netfilter_ipv6/Makefile.am
(Continue reading)

rodanber | 29 Jun 11:24 2016
Picon

[PATCH] iptables: extensions: libxt_ecn: Add translation to nft

From: Roberto García <rodanber <at> gmail.com>

Add translation of the ecn match to nftables.

Examples:
  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
  nft add rule ip filter INPUT ip ecn not-ect counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
  nft add rule ip filter INPUT ip ecn ect1 counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
  nft add rule ip filter INPUT ip ecn ect0 counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
  nft add rule ip filter INPUT ip ecn ce counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
  nft add rule ip filter INPUT ip ecn != not-ect counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
  nft add rule ip filter INPUT ip ecn != ect1 counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
  nft add rule ip filter INPUT ip ecn != ect0 counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
  nft add rule ip filter INPUT ip ecn != ce counter

Signed-off-by: Roberto García <rodanber <at> gmail.com>
(Continue reading)

Kevin Darbyshire-Bryant | 28 Jun 16:32 2016
Picon

Advice requested: de-masquerading from a qdisc?

Hello All,

First post and I'm very much in a position of not knowing what I don't 
know, so be relatively gentle if you can :-)

So, the basic question first:  Is it possible to access the NAT tables 
to de-masquerade a packet from a qdisc?

Longer question/background:  I'm slightly involved in a qdisc AQM 
project (cake) that amongst other things has 'per host' flow grouping 
modes.  Typically 2 qdiscs are instantiated, one on the WAN interface 
for egress traffic and another on a WAN IFB interface for ingress.  This 
is all fine for IPv6, but in typical usage where IPv4 masquerading is 
involved, the only host the ingress qdisc sees is the router's public 
IPv4.  Similarly the egress qdisc doesn't see the internal LAN addresses 
as it's all post NAT.

All I have in the qdisc is the skb...and it looks like the pointer to 
the nfct structure can help me but.....I'm really at the starting end of 
a learning vertical cliff.  Where should I start reading? :-)

Thanks for your time,

Kevin

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo <at> vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

(Continue reading)

rodanber | 28 Jun 21:58 2016
Picon

[PATCH] iptables: extensions: libxt_ecn: Add translation to nft

From: Roberto García <rodanber <at> gmail.com>

Add translation of the ecn match to nftables.

Examples:
  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
  nft add rule ip filter INPUT ip ecn not-ect counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
  nft add rule ip filter INPUT ip ecn ect1 counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
  nft add rule ip filter INPUT ip ecn ect0 counter

  # iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
  nft add rule ip filter INPUT ip ecn ce counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
  nft add rule ip filter INPUT ip ecn != not-ect counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
  nft add rule ip filter INPUT ip ecn != ect1 counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
  nft add rule ip filter INPUT ip ecn != ect0 counter

  # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
  nft add rule ip filter INPUT ip ecn != ce counter

Signed-off-by: Roberto García <rodanber <at> gmail.com>
(Continue reading)

Carlos Falgueras García | 27 Jun 19:05 2016
Picon
Gravatar

[PATCH 1/2 libnftnl] set: Add new attribute into 'set' to store user data

The new structure 'user' holds a pointer to user data and its length. The
kernel must have the flag NFTA_SET_USERDATA to support this feature.

Signed-off-by: Carlos Falgueras García <carlosfg <at> riseup.net>
---
 include/libnftnl/set.h |  1 +
 include/set.h          |  4 ++++
 src/set.c              | 29 +++++++++++++++++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/include/libnftnl/set.h b/include/libnftnl/set.h
index 3d50d56..5266b6f 100644
--- a/include/libnftnl/set.h
+++ b/include/libnftnl/set.h
 <at>  <at>  -22,6 +22,7  <at>  <at>  enum nftnl_set_attr {
 	NFTNL_SET_DESC_SIZE,
 	NFTNL_SET_TIMEOUT,
 	NFTNL_SET_GC_INTERVAL,
+	NFTNL_SET_USERDATA,
 	__NFTNL_SET_MAX
 };
 #define NFTNL_SET_MAX (__NFTNL_SET_MAX - 1)
diff --git a/include/set.h b/include/set.h
index c3b96f2..85bd389 100644
--- a/include/set.h
+++ b/include/set.h
 <at>  <at>  -14,6 +14,10  <at>  <at>  struct nftnl_set {
 	uint32_t		key_len;
 	uint32_t		data_type;
 	uint32_t		data_len;
(Continue reading)

Carlos Falgueras García | 27 Jun 18:24 2016
Picon
Gravatar

[PATCH libnftnl] set: Fix nftnl_set_set_str

We need the string length

Signed-off-by: Carlos Falgueras García <carlosfg <at> riseup.net>
---
 src/set.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/set.c b/src/set.c
index 879100c..edbcbe5 100644
--- a/src/set.c
+++ b/src/set.c
 <at>  <at>  -203,7 +203,7  <at>  <at>  EXPORT_SYMBOL_ALIAS(nftnl_set_set_u64, nft_set_attr_set_u64);

 int nftnl_set_set_str(struct nftnl_set *s, uint16_t attr, const char *str)
 {
-	return nftnl_set_set(s, attr, str);
+	return nftnl_set_set_data(s, attr, str, strlen(str));
 }
 EXPORT_SYMBOL_ALIAS(nftnl_set_set_str, nft_set_attr_set_str);

--

-- 
2.8.3

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo <at> vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Liping Zhang | 27 Jun 15:57 2016

[PATCH iptables] extensions: libipt_realm: fix order of mask and id when do nft translation

From: Liping Zhang <liping.zhang <at> spreadtrum.com>

Before:
  # iptables-translate -A INPUT -m realm --realm 1/0xf
  nft add rule ip filter INPUT rtclassid and 0x1 == 0xf counter

Apply this patch:
  # iptables-translate -A INPUT -m realm --realm 1/0xf
  nft add rule ip filter INPUT rtclassid and 0xf == 0x1 counter

Cc: Shivani Bhardwaj <shivanib134 <at> gmail.com>
Signed-off-by: Liping Zhang <liping.zhang <at> spreadtrum.com>
---
 extensions/libipt_realm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/extensions/libipt_realm.c b/extensions/libipt_realm.c
index beb2491..0a4bc3b 100644
--- a/extensions/libipt_realm.c
+++ b/extensions/libipt_realm.c
 <at>  <at>  -115,8 +115,8  <at>  <at>  print_realm_xlate(unsigned long id, unsigned long mask,
 	const char *name = NULL;

 	if (mask != 0xffffffff)
-		xt_xlate_add(xl, " and 0x%lx %s 0x%lx ", id,
-			   op == XT_OP_EQ ? "==" : "!=", mask);
+		xt_xlate_add(xl, " and 0x%lx %s 0x%lx ", mask,
+			   op == XT_OP_EQ ? "==" : "!=", id);
 	else {
 		if (numeric == 0)
(Continue reading)

Nicholas Vinson | 25 Jun 18:28 2016
Picon

[PATCH 1/1] nft: configure.ac: Replace magic dblatex dep.

Add a configure switch to enable and disable PDF document generation.
This switch is to replace the current method of automatically detecting
dblatex and building the PDF documentation when present.

Bug: 1074
Signed-off-by: Nicholas Vinson <nvinson234 <at> gmail.com>
---
 configure.ac | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/configure.ac b/configure.ac
index 0e7edcf..cbc7868 100644
--- a/configure.ac
+++ b/configure.ac
 <at>  <at>  -22,6 +22,12  <at>  <at>  AC_CONFIG_HEADER([config.h])
 AC_DEFINE([_GNU_SOURCE], [], [Enable various GNU extensions])
 AC_DEFINE([_STDC_FORMAT_MACROS], [], [printf-style format macros])

+AC_ARG_ENABLE([pdf-doc],
+	      AS_HELP_STRING([--disable-pdf-doc], [Disable PDF documentation]),
+	      AS_IF([test "x$enable_pdf_doc" = "xno"], [enable_pdf_doc=no],
+	      [enable_pdf_doc=yes]), [enable_pdf_doc=yes])
+AM_CONDITIONAL([BUILD_PDF], [test "x$enable_pdf_doc" == "xyes" ])
+
 AC_ARG_ENABLE([debug],
 	      AS_HELP_STRING([--enable-debug], [Disable debugging]),
 	      AS_IF([test "x$enable_debug" = "xno"], [with_debug=no], [with_debug=yes]),
 <at>  <at>  -63,11 +69,11  <at>  <at>  AS_IF([test "$DOCBOOK2X_MAN" != "no"], [DB2MAN="$DOCBOOK2X_MAN"],
 AC_SUBST(DB2MAN)
 AM_CONDITIONAL([BUILD_MAN], [test -n "$DB2MAN"])
(Continue reading)

Jordan Yelloz | 24 Jun 21:18 2016

[PATCH 1/1] extensions: added AR substitution

This is to ensure that the correct AR is run in cross-compile jobs.
Often a cross-compile build will succeed without this change but it
fails on my Gentoo Linux system when I have binutils installed with the
"multitarget" USE flag.
This change substitues AR with the autotools-supplied AR for the
extensions subdirectory.

Signed-off-by: Jordan Yelloz <jordan <at> yelloz.me>
---
 extensions/GNUmakefile.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/extensions/GNUmakefile.in b/extensions/GNUmakefile.in
index 53be2cdd0ebd..33b06efd15c2 100644
--- a/extensions/GNUmakefile.in
+++ b/extensions/GNUmakefile.in
 <at>  <at>  -11,6 +11,7  <at>  <at>  libdir       =  <at> libdir <at> 
 libexecdir   =  <at> libexecdir <at> 
 xtlibdir     =  <at> xtlibdir <at> 

+AR                 =  <at> AR <at> 
 CC                 =  <at> CC <at> 
 CCLD               = ${CC}
 CFLAGS             =  <at> CFLAGS <at> 
--

-- 
2.9.0

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo <at> vger.kernel.org
(Continue reading)

Pablo Neira Ayuso | 24 Jun 19:48 2016

[PATCH nf-next] netfilter: x_tables: simplify ip{6}table_mangle_hook()

No need for a special case for NF_INET_POST_ROUTING.

Signed-off-by: Pablo Neira Ayuso <pablo <at> netfilter.org>
---
 net/ipv4/netfilter/iptable_mangle.c  | 4 ----
 net/ipv6/netfilter/ip6table_mangle.c | 4 ----
 2 files changed, 8 deletions(-)

diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 57fc97c..aebdb33 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
 <at>  <at>  -87,10 +87,6  <at>  <at>  iptable_mangle_hook(void *priv,
 {
 	if (state->hook == NF_INET_LOCAL_OUT)
 		return ipt_mangle_out(skb, state);
-	if (state->hook == NF_INET_POST_ROUTING)
-		return ipt_do_table(skb, state,
-				    state->net->ipv4.iptable_mangle);
-	/* PREROUTING/INPUT/FORWARD: */
 	return ipt_do_table(skb, state, state->net->ipv4.iptable_mangle);
 }

diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index cb2b288..2b1a9dc 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
 <at>  <at>  -83,10 +83,6  <at>  <at>  ip6table_mangle_hook(void *priv, struct sk_buff *skb,
 {
 	if (state->hook == NF_INET_LOCAL_OUT)
(Continue reading)


Gmane