summaryrefslogtreecommitdiffstats
path: root/extensions
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2018-08-23 17:43:20 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2018-08-24 10:05:51 +0200
commit1a878a799013f1644fd7c38709669293d01887f3 (patch)
tree2904d431b37f32a202329d75082f59fec06ffcab /extensions
parent5ee03e6df41727652e0dc6ffaef8411b8840d812 (diff)
extensions: AUDIT: Provide translation
With audit logging being supported by nftables as a simple (fake) log level, translating AUDIT target is easy. Especially since xt_AUDIT in kernel doesn't quite care about --type parameter. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions')
-rw-r--r--extensions/libxt_AUDIT.c11
-rw-r--r--extensions/libxt_AUDIT.txlate8
2 files changed, 19 insertions, 0 deletions
diff --git a/extensions/libxt_AUDIT.c b/extensions/libxt_AUDIT.c
index 86a61cbe..f7832dee 100644
--- a/extensions/libxt_AUDIT.c
+++ b/extensions/libxt_AUDIT.c
@@ -82,6 +82,16 @@ static void audit_save(const void *ip, const struct xt_entry_target *target)
}
}
+static int audit_xlate(struct xt_xlate *xl,
+ const struct xt_xlate_tg_params *params)
+{
+ /* audit type is merely sanity checked by xt_AUDIT.ko,
+ * so nftables doesn't even support it */
+
+ xt_xlate_add(xl, "log level audit");
+ return 1;
+}
+
static struct xtables_target audit_tg_reg = {
.name = "AUDIT",
.version = XTABLES_VERSION,
@@ -93,6 +103,7 @@ static struct xtables_target audit_tg_reg = {
.save = audit_save,
.x6_parse = audit_parse,
.x6_options = audit_opts,
+ .xlate = audit_xlate,
};
void _init(void)
diff --git a/extensions/libxt_AUDIT.txlate b/extensions/libxt_AUDIT.txlate
new file mode 100644
index 00000000..abd11eae
--- /dev/null
+++ b/extensions/libxt_AUDIT.txlate
@@ -0,0 +1,8 @@
+iptables-translate -t filter -A INPUT -j AUDIT --type accept
+nft add rule ip filter INPUT counter log level audit
+
+iptables-translate -t filter -A INPUT -j AUDIT --type drop
+nft add rule ip filter INPUT counter log level audit
+
+iptables-translate -t filter -A INPUT -j AUDIT --type reject
+nft add rule ip filter INPUT counter log level audit