diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-04-11 12:31:39 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-02-16 19:30:21 +0100 |
commit | 933400b37d0966980d07d32b64403830429761ed (patch) | |
tree | a2540049b9e8c1d679bc2d8a096f0ffc629b9d36 /iptables/nft-shared.h | |
parent | d13b60c9ddb48e651b92f13579e236c530658176 (diff) |
nft: xtables: add the infrastructure to translate from iptables to nft
This patch provides the infrastructure and two new utilities to
translate iptables commands to nft, they are:
1) iptables-restore-translate which basically takes a file that contains
the ruleset in iptables-restore format and converts it to the nft
syntax, eg.
% iptables-restore-translate -f ipt-ruleset > nft-ruleset
% cat nft-ruleset
# Translated by iptables-restore-translate v1.4.21 on Mon Apr 14 12:18:14 2014
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; }
add chain ip filter FORWARD { type filter hook forward priority 0; }
add chain ip filter OUTPUT { type filter hook output priority 0; }
add rule ip filter INPUT iifname lo counter accept
# -t filter -A INPUT -m state --state INVALID -j LOG --log-prefix invalid:
...
The rules that cannot be translated are left commented. Users should be able
to run this to track down the nft progress to see at what point it can fully
replace iptables and their filtering policy.
2) iptables-translate which suggests a translation for an iptables
command:
$ iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
nft add rule filter OUTPUT ip protocol udp ip dst 8.8.8.8 counter accept
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft-shared.h')
-rw-r--r-- | iptables/nft-shared.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h index 56d75f82..73861833 100644 --- a/iptables/nft-shared.h +++ b/iptables/nft-shared.h @@ -37,6 +37,7 @@ #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab)) struct xtables_args; +struct xt_buf; enum { NFT_XT_CTX_PAYLOAD = (1 << 0), @@ -101,6 +102,7 @@ struct nft_family_ops { void (*parse_target)(struct xtables_target *t, void *data); bool (*rule_find)(struct nft_family_ops *ops, struct nftnl_rule *r, void *data); + int (*xlate)(const void *data, struct xt_buf *buf); }; void add_meta(struct nftnl_rule *r, uint32_t key); |