diff options
| author | Ana Rey <anarey@gmail.com> | 2014-04-16 09:19:40 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-02-16 19:30:21 +0100 |
| commit | 04f569ded54a75243b39c125d63a044f5225a99b (patch) | |
| tree | 004aeea54dd528adaff027c5df7d80104792a9ce | |
| parent | 0afd957f6bc03b17fac8824e50b2e0fbd3d6f153 (diff) | |
extensions: libxt_udp: add translation to nft
Some examples:
$ sudo iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
add rule ip filter INPUT iifname eth0 udp sport 53 counter accept
$ sudo ./iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP
add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop
$ sudo ./iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept
Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | extensions/libxt_udp.c | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c index b9f39ee4..0b89df4f 100644 --- a/extensions/libxt_udp.c +++ b/extensions/libxt_udp.c @@ -152,6 +152,42 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) } } +static int udp_xlate(const struct xt_entry_match *match, struct xt_buf *buf, + int numeric) +{ + const struct xt_udp *udpinfo = (struct xt_udp *)match->data; + + if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { + if (udpinfo->spts[0] != udpinfo->spts[1]) { + xt_buf_add(buf,"udp sport %s%u-%u ", + udpinfo->invflags & XT_UDP_INV_SRCPT ? + "!= ": "", + udpinfo->spts[0], udpinfo->spts[1]); + } else { + xt_buf_add(buf, "udp sport %s%u ", + udpinfo->invflags & XT_UDP_INV_SRCPT ? + "!= ": "", + udpinfo->spts[0]); + } + } + + if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { + if (udpinfo->dpts[0] != udpinfo->dpts[1]) { + xt_buf_add(buf,"udp dport %s%u-%u ", + udpinfo->invflags & XT_UDP_INV_SRCPT ? + "!= ": "", + udpinfo->dpts[0], udpinfo->dpts[1]); + } else { + xt_buf_add(buf,"udp dport %s%u ", + udpinfo->invflags & XT_UDP_INV_SRCPT ? + "!= ": "", + udpinfo->dpts[0]); + } + } + + return 1; +} + static struct xtables_match udp_match = { .family = NFPROTO_UNSPEC, .name = "udp", @@ -164,6 +200,7 @@ static struct xtables_match udp_match = { .save = udp_save, .x6_parse = udp_parse, .x6_options = udp_opts, + .xlate = udp_xlate, }; void |