summaryrefslogtreecommitdiffstats
path: root/extensions/libip6t_DNAT.c
Commit message (Collapse)AuthorAgeFilesLines
* extensions: ip6t_{S,D}NAT: multiple to-dst/to-src arguments not reportedThierry Du Tre2018-01-161-7/+5
| | | | | | | | | | | | | | | | | | | | | | This patch is fixing the detection of multiple '--to-destination' in a DNAT rule and '--to-source' in SNAT rule for IPv6. Currently, when defining multiple values for these, only the last will be used and others ignored silently. The checks for (cb->xflags & F_X_TO_[DEST/SRC]) always fails because the flags are never set before. It seems to be a copy-paste artefact since introduction of the IPv6 DNAT/SNAT extensions based on IPv4 code. I also removed the kernel_version checks because they seem useless. Extensions for IPv6 DNAT/SNAT are using xt_target with revision 1. That seems only added since kernel version 3.7-rc1 and therefore the check for > v2.6.10 will always return true. The check is probably also coming from the IPv4 copy-paste. Add tests to cover this too, including the IPv4 side. Signed-off-by: Thierry Du Tre <thierry@dtsystems.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_SNAT/DNAT: add square bracket in xlat output when port ↵Liping Zhang2016-09-051-7/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | is specified It is better to add square brackets to ip6 address in nft translation output when the port is specified. This is keep consistent with the nft syntax. Before this patch: # ip6tables-translate -t nat -A OUTPUT -p tcp -j DNAT --to-destination \ [123::4]:1 nft add rule ip6 nat OUTPUT meta l4proto tcp counter dnat to 123::4 :1 # ip6tables-translate -t nat -A POSTROUTING -p tcp -j SNAT --to-source \ [123::4-123::8]:1 nft add rule ip6 nat POSTROUTING meta l4proto tcp counter snat to 123::4-123::8 :1 Apply this patch: # ip6tables-translate -t nat -A OUTPUT -p tcp -j DNAT --to-destination \ [123::4]:1 nft add rule ip6 nat OUTPUT meta l4proto tcp counter dnat to [123::4]:1 # ip6tables-translate -t nat -A POSTROUTING -p tcp -j SNAT --to-source \ [123::4-123::8]:1 nft add rule ip6 nat POSTROUTING meta l4proto tcp counter snat to [123::4]-[123::8]:1 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip[6]t_SNAT/DNAT: use the new nft syntax when do xlateLiping Zhang2016-08-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | After commit "src: add 'to' for snat and dnat" in nftables tree, we should recommend the end user to use the new syntax. Before this patch: # iptables-translate -t nat -A POSTROUTING -j SNAT --to-source 1.1.1.1 nft add rule ip nat POSTROUTING counter snat 1.1.1.1 # ip6tables-translate -t nat -A PREROUTING -j DNAT --to-destination 2001::1 nft add rule ip6 nat PREROUTING counter dnat 2001::1 Apply this patch: # iptables-translate -t nat -A POSTROUTING -j SNAT --to-source 1.1.1.1 nft add rule ip nat POSTROUTING counter snat to 1.1.1.1 # ip6tables-translate -t nat -A PREROUTING -j DNAT --to-destination 2001::1 nft add rule ip6 nat PREROUTING counter dnat to 2001::1 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce struct xt_xlate_{mt,tg}_paramsPablo Neira Ayuso2016-07-251-3/+3
| | | | | | | | This structure is an extensible containers of parameters, so we don't need to propagate interface updates in every extension file in case we need to add new parameters in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: pass ipt_entry and ip6t_entry to ->xlate()Pablo Neira Ayuso2016-03-091-1/+1
| | | | | | | The multiport match needs it, this basically leaves ->xlate() indirection with almost the same interface as ->print(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: rename xt_buf to xt_xlatePablo Neira Ayuso2016-02-161-10/+10
| | | | | | | Use a more generic name for this object to prepare the introduction of other translation specific fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_DNAT: Add translation to nftShivani Bhardwaj2016-02-161-0/+44
| | | | | | | | | | | | | | | | | | | | | Add translation for target DNAT to nftables. Examples: $ sudo ip6tables-translate -t nat -A prerouting -i eth1 -p tcp --dport 8080 -j DNAT --to-destination [fec0::1234]:80 nft add rule ip6 nat prerouting iifname eth1 tcp dport 8080 counter dnat fec0::1234 :80 $ sudo ip6tables-translate -t nat -A prerouting -p tcp -j DNAT --to-destination [fec0::1234]:1-20 nft add rule ip6 nat prerouting ip6 nexthdr tcp counter dnat fec0::1234 :1-20 $ sudo ip6tables-translate -t nat -A prerouting -p tcp -j DNAT --to-destination [fec0::1234]:80 --persistent nft add rule ip6 nat prerouting ip6 nexthdr tcp counter dnat fec0::1234 :80 persistent $ sudo ip6tables-translate -t nat -A prerouting -p tcp -j DNAT --to-destination [fec0::1234]:80 --random --persistent nft add rule ip6 nat prerouting ip6 nexthdr tcp counter dnat fec0::1234 :80 random,persistent Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_DNAT: set IPv6 DNAT --to-destinationUlrich Weber2013-01-041-5/+5
| | | | | | | as in IPv4 and fixes DNAT_save Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extension: libip6t_DNAT: allow port DNAT without addressUlrich Weber2013-01-041-3/+8
| | | | | | | | | | | | | | | | | | | | | | | correct parsing of IPv6 port NAT without address NAT, assume one colon as port information. Allows: * address only: -j DNAT --to affe::1 -j DNAT --to [affe::1] * port only -j DNAT --to :80 -j DNAT --to :80-110 -j DNAT --to []:80 -j DNAT --to []:80-110 * address and port -j DNAT --to [affe::1]:80 -j DNAT --to [affe::1]:80-110 Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: add IPv6 DNAT targetPatrick McHardy2012-09-101-0/+247
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-13 06:25:20 +0000