diff options
| author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-10-07 19:08:56 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-14 18:59:36 +0200 |
| commit | 925e2837ec15135390fea17737a7f7491fe2947b (patch) | |
| tree | 27e7f69682319025840bc49b033aa1cdc5d465e5 | |
| parent | 1525081714ef5361e981325f20bc6b48a169570e (diff) | |
| download | platform_external_iptables-925e2837ec15135390fea17737a7f7491fe2947b.tar.gz platform_external_iptables-925e2837ec15135390fea17737a7f7491fe2947b.tar.bz2 platform_external_iptables-925e2837ec15135390fea17737a7f7491fe2947b.zip | |
extensions: libxt_statistic: add translation to nft
For example:
# iptables-translate -A OUTPUT -m statistic --mode nth --every 10 \
--packet 1
nft add rule ip filter OUTPUT numgen inc mod 10 1 counter
# iptables-translate -A OUTPUT -m statistic --mode nth ! --every 10 \
--packet 5
nft add rule ip filter OUTPUT numgen inc mod 10 != 5 counter
Note, mode random is not completely supported in nft, so:
# iptables-translate -A OUTPUT -m statistic --mode random \
--probability 0.1
nft # -A OUTPUT -m statistic --mode random --probability 0.1
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | extensions/libxt_statistic.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/extensions/libxt_statistic.c b/extensions/libxt_statistic.c index b6ae5f5c..4f3341a3 100644 --- a/extensions/libxt_statistic.c +++ b/extensions/libxt_statistic.c @@ -133,6 +133,26 @@ static void statistic_save(const void *ip, const struct xt_entry_match *match) print_match(info, "--"); } +static int statistic_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) +{ + const struct xt_statistic_info *info = + (struct xt_statistic_info *)params->match->data; + + switch (info->mode) { + case XT_STATISTIC_MODE_RANDOM: + return 0; + case XT_STATISTIC_MODE_NTH: + xt_xlate_add(xl, "numgen inc mod %u %s%u", + info->u.nth.every + 1, + info->flags & XT_STATISTIC_INVERT ? "!= " : "", + info->u.nth.packet); + break; + } + + return 1; +} + static struct xtables_match statistic_match = { .family = NFPROTO_UNSPEC, .name = "statistic", @@ -145,6 +165,7 @@ static struct xtables_match statistic_match = { .print = statistic_print, .save = statistic_save, .x6_options = statistic_opts, + .xlate = statistic_xlate, }; void _init(void) |