summaryrefslogtreecommitdiffstats
path: root/extensions
diff options
context:
space:
mode:
Diffstat (limited to 'extensions')
-rw-r--r--extensions/libip6t_MASQUERADE.c2
-rw-r--r--extensions/libxt_conntrack.c46
-rw-r--r--extensions/libxt_conntrack.txlate8
-rw-r--r--extensions/libxt_devgroup.man2
-rw-r--r--extensions/libxt_hashlimit.t6
-rw-r--r--extensions/libxt_mac.c4
-rw-r--r--extensions/libxt_multiport.c38
-rw-r--r--extensions/libxt_multiport.txlate3
8 files changed, 56 insertions, 53 deletions
diff --git a/extensions/libip6t_MASQUERADE.c b/extensions/libip6t_MASQUERADE.c
index f92760fa..f28f071b 100644
--- a/extensions/libip6t_MASQUERADE.c
+++ b/extensions/libip6t_MASQUERADE.c
@@ -163,7 +163,7 @@ static int MASQUERADE_xlate(struct xt_xlate *xl,
xt_xlate_add(xl, " ");
if (r->flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY)
- xt_xlate_add(xl, "random-fully ");
+ xt_xlate_add(xl, "fully-random ");
return 1;
}
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index 7f7b45ee..64018ce1 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -1151,40 +1151,30 @@ static void state_save(const void *ip, const struct xt_entry_match *match)
static void state_xlate_print(struct xt_xlate *xl, unsigned int statemask, int inverted)
{
const char *sep = "";
- int one_flag_set;
- one_flag_set = !(statemask & (statemask - 1));
-
- if (inverted && !one_flag_set)
- xt_xlate_add(xl, "& (");
- else if (inverted)
- xt_xlate_add(xl, "& ");
+ if (inverted)
+ xt_xlate_add(xl, "! ");
if (statemask & XT_CONNTRACK_STATE_INVALID) {
xt_xlate_add(xl, "%s%s", sep, "invalid");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_NEW)) {
xt_xlate_add(xl, "%s%s", sep, "new");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_RELATED)) {
xt_xlate_add(xl, "%s%s", sep, "related");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_ESTABLISHED)) {
xt_xlate_add(xl, "%s%s", sep, "established");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
if (statemask & XT_CONNTRACK_STATE_UNTRACKED) {
xt_xlate_add(xl, "%s%s", sep, "untracked");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
-
- if (inverted && !one_flag_set)
- xt_xlate_add(xl, ") == 0");
- else if (inverted)
- xt_xlate_add(xl, " == 0");
}
static int state_xlate(struct xt_xlate *xl,
@@ -1203,36 +1193,26 @@ static int state_xlate(struct xt_xlate *xl,
static void status_xlate_print(struct xt_xlate *xl, unsigned int statusmask, int inverted)
{
const char *sep = "";
- int one_flag_set;
- one_flag_set = !(statusmask & (statusmask - 1));
-
- if (inverted && !one_flag_set)
- xt_xlate_add(xl, "& (");
- else if (inverted)
- xt_xlate_add(xl, "& ");
+ if (inverted)
+ xt_xlate_add(xl, "! ");
if (statusmask & IPS_EXPECTED) {
xt_xlate_add(xl, "%s%s", sep, "expected");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
if (statusmask & IPS_SEEN_REPLY) {
xt_xlate_add(xl, "%s%s", sep, "seen-reply");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
if (statusmask & IPS_ASSURED) {
xt_xlate_add(xl, "%s%s", sep, "assured");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
if (statusmask & IPS_CONFIRMED) {
xt_xlate_add(xl, "%s%s", sep, "confirmed");
- sep = inverted && !one_flag_set ? "|" : ",";
+ sep = ",";
}
-
- if (inverted && !one_flag_set)
- xt_xlate_add(xl, ") == 0");
- else if (inverted)
- xt_xlate_add(xl, " == 0");
}
static void addr_xlate_print(struct xt_xlate *xl,
diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
index 8cc7c504..45fba984 100644
--- a/extensions/libxt_conntrack.txlate
+++ b/extensions/libxt_conntrack.txlate
@@ -2,10 +2,10 @@ iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW,RELATED -j ACCE
nft add rule ip filter INPUT ct state new,related counter accept
ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW,RELATED -j ACCEPT
-nft add rule ip6 filter INPUT ct state & (new|related) == 0 counter accept
+nft add rule ip6 filter INPUT ct state ! new,related counter accept
ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW -j ACCEPT
-nft add rule ip6 filter INPUT ct state & new == 0 counter accept
+nft add rule ip6 filter INPUT ct state ! new counter accept
iptables-translate -t filter -A INPUT -m conntrack --ctproto UDP -j ACCEPT
nft add rule ip filter INPUT ct original protocol 17 counter accept
@@ -35,10 +35,10 @@ iptables-translate -t filter -A INPUT -m conntrack --ctstatus EXPECTED -j ACCEPT
nft add rule ip filter INPUT ct status expected counter accept
iptables-translate -t filter -A INPUT -m conntrack ! --ctstatus CONFIRMED -j ACCEPT
-nft add rule ip filter INPUT ct status & confirmed == 0 counter accept
+nft add rule ip filter INPUT ct status ! confirmed counter accept
iptables-translate -t filter -A INPUT -m conntrack ! --ctstatus CONFIRMED,ASSURED -j ACCEPT
-nft add rule ip filter INPUT ct status & (assured|confirmed) == 0 counter accept
+nft add rule ip filter INPUT ct status ! assured,confirmed counter accept
iptables-translate -t filter -A INPUT -m conntrack --ctstatus CONFIRMED,ASSURED -j ACCEPT
nft add rule ip filter INPUT ct status assured,confirmed counter accept
diff --git a/extensions/libxt_devgroup.man b/extensions/libxt_devgroup.man
index 4a66c9fe..480ee351 100644
--- a/extensions/libxt_devgroup.man
+++ b/extensions/libxt_devgroup.man
@@ -1,4 +1,4 @@
-Match device group of a packets incoming/outgoing interface.
+Match device group of a packet's incoming/outgoing interface.
.TP
[\fB!\fP] \fB\-\-src\-group\fP \fIname\fP
Match device group of incoming device
diff --git a/extensions/libxt_hashlimit.t b/extensions/libxt_hashlimit.t
index ccd0d1e6..83699337 100644
--- a/extensions/libxt_hashlimit.t
+++ b/extensions/libxt_hashlimit.t
@@ -3,14 +3,12 @@
-m hashlimit --hashlimit-above 1000000/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
-m hashlimit --hashlimit-above 1/min --hashlimit-burst 5 --hashlimit-name mini1;=;OK
-m hashlimit --hashlimit-above 1/hour --hashlimit-burst 5 --hashlimit-name mini1;=;OK
-# kernel says "xt_hashlimit: overflow, try lower: 864000000/5"
--m hashlimit --hashlimit-above 1/day --hashlimit-burst 5 --hashlimit-name mini1;;FAIL
+-m hashlimit --hashlimit-above 1/day --hashlimit-burst 500 --hashlimit-name mini1;=;OK
-m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
-m hashlimit --hashlimit-upto 1000000/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
-m hashlimit --hashlimit-upto 1/min --hashlimit-burst 5 --hashlimit-name mini1;=;OK
-m hashlimit --hashlimit-upto 1/hour --hashlimit-burst 5 --hashlimit-name mini1;=;OK
-# kernel says "xt_hashlimit: overflow, try lower: 864000000/5"
--m hashlimit --hashlimit-upto 1/day --hashlimit-burst 5 --hashlimit-name mini1;;FAIL
+-m hashlimit --hashlimit-upto 1/day --hashlimit-burst 500 --hashlimit-name mini1;=;OK
-m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
-m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
-m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode dstip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
diff --git a/extensions/libxt_mac.c b/extensions/libxt_mac.c
index b90eef20..55891b2b 100644
--- a/extensions/libxt_mac.c
+++ b/extensions/libxt_mac.c
@@ -42,10 +42,10 @@ mac_print(const void *ip, const struct xt_entry_match *match, int numeric)
{
const struct xt_mac_info *info = (void *)match->data;
- printf(" MAC");
+ printf(" MAC ");
if (info->invert)
- printf(" !");
+ printf("! ");
xtables_print_mac(info->srcaddr);
}
diff --git a/extensions/libxt_multiport.c b/extensions/libxt_multiport.c
index 4a42fa38..6b0c8190 100644
--- a/extensions/libxt_multiport.c
+++ b/extensions/libxt_multiport.c
@@ -465,7 +465,8 @@ static void multiport_save6_v1(const void *ip_void,
}
static int __multiport_xlate(struct xt_xlate *xl,
- const struct xt_xlate_mt_params *params)
+ const struct xt_xlate_mt_params *params,
+ uint8_t proto)
{
const struct xt_multiport *multiinfo
= (const struct xt_multiport *)params->match->data;
@@ -479,7 +480,17 @@ static int __multiport_xlate(struct xt_xlate *xl,
xt_xlate_add(xl, " dport ");
break;
case XT_MULTIPORT_EITHER:
- return 0;
+ xt_xlate_add(xl, " sport . %s dport { ", proto_to_name(proto));
+ for (i = 0; i < multiinfo->count; i++) {
+ if (i != 0)
+ xt_xlate_add(xl, ", ");
+
+ xt_xlate_add(xl, "0-65535 . %u, %u . 0-65535",
+ multiinfo->ports[i], multiinfo->ports[i]);
+ }
+ xt_xlate_add(xl, " }");
+
+ return 1;
}
if (multiinfo->count > 1)
@@ -500,7 +511,7 @@ static int multiport_xlate(struct xt_xlate *xl,
uint8_t proto = ((const struct ipt_ip *)params->ip)->proto;
xt_xlate_add(xl, "%s", proto_to_name(proto));
- return __multiport_xlate(xl, params);
+ return __multiport_xlate(xl, params, proto);
}
static int multiport_xlate6(struct xt_xlate *xl,
@@ -509,11 +520,12 @@ static int multiport_xlate6(struct xt_xlate *xl,
uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto;
xt_xlate_add(xl, "%s", proto_to_name(proto));
- return __multiport_xlate(xl, params);
+ return __multiport_xlate(xl, params, proto);
}
static int __multiport_xlate_v1(struct xt_xlate *xl,
- const struct xt_xlate_mt_params *params)
+ const struct xt_xlate_mt_params *params,
+ uint8_t proto)
{
const struct xt_multiport_v1 *multiinfo =
(const struct xt_multiport_v1 *)params->match->data;
@@ -527,7 +539,17 @@ static int __multiport_xlate_v1(struct xt_xlate *xl,
xt_xlate_add(xl, " dport ");
break;
case XT_MULTIPORT_EITHER:
- return 0;
+ xt_xlate_add(xl, " sport . %s dport { ", proto_to_name(proto));
+ for (i = 0; i < multiinfo->count; i++) {
+ if (i != 0)
+ xt_xlate_add(xl, ", ");
+
+ xt_xlate_add(xl, "0-65535 . %u, %u . 0-65535",
+ multiinfo->ports[i], multiinfo->ports[i]);
+ }
+ xt_xlate_add(xl, " }");
+
+ return 1;
}
if (multiinfo->invert)
@@ -556,7 +578,7 @@ static int multiport_xlate_v1(struct xt_xlate *xl,
uint8_t proto = ((const struct ipt_ip *)params->ip)->proto;
xt_xlate_add(xl, "%s", proto_to_name(proto));
- return __multiport_xlate_v1(xl, params);
+ return __multiport_xlate_v1(xl, params, proto);
}
static int multiport_xlate6_v1(struct xt_xlate *xl,
@@ -565,7 +587,7 @@ static int multiport_xlate6_v1(struct xt_xlate *xl,
uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto;
xt_xlate_add(xl, "%s", proto_to_name(proto));
- return __multiport_xlate_v1(xl, params);
+ return __multiport_xlate_v1(xl, params, proto);
}
static struct xtables_match multiport_mt_reg[] = {
diff --git a/extensions/libxt_multiport.txlate b/extensions/libxt_multiport.txlate
index 752e7148..bced1b84 100644
--- a/extensions/libxt_multiport.txlate
+++ b/extensions/libxt_multiport.txlate
@@ -9,3 +9,6 @@ nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept
iptables-translate -t filter -A INPUT -p tcp -m multiport --sports 50 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp sport 50 counter accept
+
+iptables-translate -t filter -I INPUT -p tcp -m multiport --ports 10
+nft insert rule ip filter INPUT ip protocol tcp tcp sport . tcp dport { 0-65535 . 10, 10 . 0-65535 } counter