diff options
author | Florian Westphal <fw@strlen.de> | 2021-11-28 18:25:53 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2021-11-28 18:26:17 +0100 |
commit | 273d88a7744ea5638969ad3252acf518e5ec6cc2 (patch) | |
tree | 170071db82e03b590e9d92c8531681cd41f4a0d0 /extensions | |
parent | 7213561d9d7a17c4db29c867b2607241941dae5a (diff) |
extensions: tcpmss: add iptables-translate support
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'extensions')
-rw-r--r-- | extensions/libxt_tcpmss.c | 16 | ||||
-rw-r--r-- | extensions/libxt_tcpmss.txlate | 11 |
2 files changed, 27 insertions, 0 deletions
diff --git a/extensions/libxt_tcpmss.c b/extensions/libxt_tcpmss.c index bcd357aa..61b853d1 100644 --- a/extensions/libxt_tcpmss.c +++ b/extensions/libxt_tcpmss.c @@ -60,6 +60,21 @@ static void tcpmss_save(const void *ip, const struct xt_entry_match *match) printf("%u:%u", info->mss_min, info->mss_max); } +static int tcpmss_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) +{ + const struct xt_tcpmss_match_info *info = (void *)params->match->data; + + xt_xlate_add(xl, "tcp option maxseg size %s", info->invert ? "!= " : ""); + + if (info->mss_min == info->mss_max) + xt_xlate_add(xl, "%u", info->mss_min); + else + xt_xlate_add(xl, "%u-%u", info->mss_min, info->mss_max); + + return 1; +} + static struct xtables_match tcpmss_match = { .family = NFPROTO_UNSPEC, .name = "tcpmss", @@ -71,6 +86,7 @@ static struct xtables_match tcpmss_match = { .save = tcpmss_save, .x6_parse = tcpmss_parse, .x6_options = tcpmss_opts, + .xlate = tcpmss_xlate, }; void _init(void) diff --git a/extensions/libxt_tcpmss.txlate b/extensions/libxt_tcpmss.txlate new file mode 100644 index 00000000..d3f1b27d --- /dev/null +++ b/extensions/libxt_tcpmss.txlate @@ -0,0 +1,11 @@ +iptables-translate -A INPUT -m tcpmss --mss 42 +nft add rule ip filter INPUT tcp option maxseg size 42 counter + +iptables-translate -A INPUT -m tcpmss ! --mss 42 +nft add rule ip filter INPUT tcp option maxseg size != 42 counter + +iptables-translate -A INPUT -m tcpmss --mss 42:1024 +nft add rule ip filter INPUT tcp option maxseg size 42-1024 counter + +iptables-translate -A INPUT -m tcpmss ! --mss 1461:65535 +nft add rule ip filter INPUT tcp option maxseg size != 1461-65535 counter |