diff options
author | Liping Zhang <zlpnobody@gmail.com> | 2017-01-07 22:26:46 +0800 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-01-16 14:13:58 +0100 |
commit | 1123e6a069123756c6c73d5557d06bc5fc31497e (patch) | |
tree | 90af06cfb67d784bed27f194606d04767b9b08d0 /extensions | |
parent | aa98227ce600cf52dbcf41e26002db1f5395a871 (diff) |
extensions: libxt_rpfilter: add translation to nft
For example:
# iptables-translate -t mangle -A PREROUTING -m rpfilter
nft add rule ip mangle PREROUTING fib saddr . iif oif != 0 counter
# iptables-translate -t mangle -A PREROUTING -m rpfilter --validmark \
--loose
nft add rule ip mangle PREROUTING fib saddr . mark oif != 0 counter
# ip6tables-translate -t mangle -A PREROUTING -m rpfilter --validmark \
--invert
nft add rule ip6 mangle PREROUTING fib saddr . mark . iif oif 0 counter
Finally, when the "--accept-local" option is specified, we can combine
with "fib saddr type" to simulate it.
But when it is used like this: "-m rpfilter --accept-local", it means "||"
relationship, so we cannot translate it to one single nft rule,
translation is not supported yet:
# iptables-translate -t mangle -A PREROUTING -m rpfilter --accept-local
nft # -t mangle -A PREROUTING -m rpfilter --accept-local
When "--accpet-local" is combined with "--invert", it means "&&"
relationship, so translation can be:
# iptables-translate -t mangle -A PREROUTING -m rpfilter \
--accept-local --invert
nft add rule ip mangle PREROUTING fib saddr type != local fib saddr \
. iif oif 0 counter
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions')
-rw-r--r-- | extensions/libxt_rpfilter.c | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/extensions/libxt_rpfilter.c b/extensions/libxt_rpfilter.c index 168e703f..d166baa2 100644 --- a/extensions/libxt_rpfilter.c +++ b/extensions/libxt_rpfilter.c @@ -77,6 +77,31 @@ static void rpfilter_save(const void *ip, const struct xt_entry_match *match) return rpfilter_print_prefix(ip, match->data, "--"); } +static int rpfilter_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) +{ + const struct xt_rpfilter_info *info = (void *)params->match->data; + bool invert = info->flags & XT_RPFILTER_INVERT; + + if (info->flags & XT_RPFILTER_ACCEPT_LOCAL) { + if (invert) + xt_xlate_add(xl, "fib saddr type != local "); + else + return 0; + } + + xt_xlate_add(xl, "fib saddr "); + + if (info->flags & XT_RPFILTER_VALID_MARK) + xt_xlate_add(xl, ". mark "); + if (!(info->flags & XT_RPFILTER_LOOSE)) + xt_xlate_add(xl, ". iif "); + + xt_xlate_add(xl, "oif %s0", invert ? "" : "!= "); + + return 1; +} + static struct xtables_match rpfilter_match = { .family = NFPROTO_UNSPEC, .name = "rpfilter", @@ -88,6 +113,7 @@ static struct xtables_match rpfilter_match = { .save = rpfilter_save, .x6_parse = rpfilter_parse, .x6_options = rpfilter_opts, + .xlate = rpfilter_xlate, }; void _init(void) |