summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAna Rey <anarey@gmail.com>2014-04-16 09:19:40 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2016-02-16 19:30:21 +0100
commit04f569ded54a75243b39c125d63a044f5225a99b (patch)
tree004aeea54dd528adaff027c5df7d80104792a9ce
parent0afd957f6bc03b17fac8824e50b2e0fbd3d6f153 (diff)
extensions: libxt_udp: add translation to nft
Some examples: $ sudo iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT add rule ip filter INPUT iifname eth0 udp sport 53 counter accept $ sudo ./iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop $ sudo ./iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--extensions/libxt_udp.c37
1 files changed, 37 insertions, 0 deletions
diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c
index b9f39ee4..0b89df4f 100644
--- a/extensions/libxt_udp.c
+++ b/extensions/libxt_udp.c
@@ -152,6 +152,42 @@ static void udp_save(const void *ip, const struct xt_entry_match *match)
}
}
+static int udp_xlate(const struct xt_entry_match *match, struct xt_buf *buf,
+ int numeric)
+{
+ const struct xt_udp *udpinfo = (struct xt_udp *)match->data;
+
+ if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) {
+ if (udpinfo->spts[0] != udpinfo->spts[1]) {
+ xt_buf_add(buf,"udp sport %s%u-%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->spts[0], udpinfo->spts[1]);
+ } else {
+ xt_buf_add(buf, "udp sport %s%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->spts[0]);
+ }
+ }
+
+ if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) {
+ if (udpinfo->dpts[0] != udpinfo->dpts[1]) {
+ xt_buf_add(buf,"udp dport %s%u-%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->dpts[0], udpinfo->dpts[1]);
+ } else {
+ xt_buf_add(buf,"udp dport %s%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->dpts[0]);
+ }
+ }
+
+ return 1;
+}
+
static struct xtables_match udp_match = {
.family = NFPROTO_UNSPEC,
.name = "udp",
@@ -164,6 +200,7 @@ static struct xtables_match udp_match = {
.save = udp_save,
.x6_parse = udp_parse,
.x6_options = udp_opts,
+ .xlate = udp_xlate,
};
void