netdev - [PATCH iproute2] tc: adjust xtables_match and xtables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 24 Jun 2019 18:14:57 +0300
From:   Eyal Birger <eyal.birger@...il.com>
To:     stephen@...workplumber.org
Cc:     netdev@...r.kernel.org, dsahern@...il.com,
        Eyal Birger <eyal.birger@...il.com>
Subject: [PATCH iproute2] tc: adjust xtables_match and xtables_target to changes in recent iptables

iptables commit 933400b37d09 ("nft: xtables: add the infrastructure to translate from iptables to nft")
added an additional member to struct xtables_match and struct xtables_target.

This change is available for libxtables12 and up.
Add these members conditionally to support both newer and older versions.

Fixes: dd29621578d2 ("tc: add em_ipt ematch for calling xtables matches from tc matching context")
Signed-off-by: Eyal Birger <eyal.birger@...il.com>
---
 include/xtables.h | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/include/xtables.h b/include/xtables.h
index b48c3166..583619f4 100644
--- a/include/xtables.h
+++ b/include/xtables.h
@@ -206,6 +206,24 @@ enum xtables_ext_flags {
 	XTABLES_EXT_ALIAS = 1 << 0,
 };
 
+#if XTABLES_VERSION_CODE >= 12
+struct xt_xlate;
+
+struct xt_xlate_mt_params {
+	const void			*ip;
+	const struct xt_entry_match	*match;
+	int				numeric;
+	bool				escape_quotes;
+};
+
+struct xt_xlate_tg_params {
+	const void			*ip;
+	const struct xt_entry_target	*target;
+	int				numeric;
+	bool				escape_quotes;
+};
+#endif
+
 /* Include file for additions: new matches and targets. */
 struct xtables_match
 {
@@ -270,6 +288,12 @@ struct xtables_match
 	void (*x6_fcheck)(struct xt_fcheck_call *);
 	const struct xt_option_entry *x6_options;
 
+#if XTABLES_VERSION_CODE >= 12
+	/* Translate iptables to nft */
+	int (*xlate)(struct xt_xlate *xl,
+		     const struct xt_xlate_mt_params *params);
+#endif
+
 	/* Size of per-extension instance extra "global" scratch space */
 	size_t udata_size;
 
@@ -347,6 +371,12 @@ struct xtables_target
 	void (*x6_fcheck)(struct xt_fcheck_call *);
 	const struct xt_option_entry *x6_options;
 
+#if XTABLES_VERSION_CODE >= 12
+	/* Translate iptables to nft */
+	int (*xlate)(struct xt_xlate *xl,
+		     const struct xt_xlate_tg_params *params);
+#endif
+
 	size_t udata_size;
 
 	/* Ignore these men behind the curtain: */
-- 
2.17.1