summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* libxtables: missing comment initialization in xt_xlate_alloc()Pablo Neira Ayuso2016-03-251-0/+1
| | | | | | Initialize comment buffer when allocation the xt translation structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: Show support for connlabelShivani Bhardwaj2016-03-221-9/+22
| | | | | | | | | | | | | | | | | | | | | Add the --disable-connlabel option and the appropriate functionality associated with it. After this patch, iptables configuration shows up as: Iptables Configuration: IPv4 support: yes IPv6 support: yes Devel support: yes IPQ support: no Large file support: yes BPF utils support: no nfsynproxy util support: no nftables support: yes connlabel support: yes Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: translate iptables --flushGuruswamy Basavaiah2016-03-221-0/+8
| | | | | | | | | | | | | translation for iptables --flush Examples: $ sudo iptables-translate -F INPUT nft flush chain ip filter INPUT $ sudo iptables-translate -F -t nat nft flush table ip nat Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_REJECT: Avoid to print the default reject with value in ↵Laura Garcia Liebana2016-03-171-1/+4
| | | | | | | | | | | | | | | | | | | | the translation Avoid to print the reject with value in the translation when the value is the default. Before this patch: $ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip6 filter FORWARD tcp dport 22 counter reject with icmpv6 type port-unreachable After this patch: $ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip6 filter FORWARD tcp dport 22 counter reject Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_REJECT: Avoid to print the default reject with value in ↵Laura Garcia Liebana2016-03-171-1/+3
| | | | | | | | | | | | | | | | | | | the translation Avoid to print the reject with value in the translation when the value is the default. Before this patch: $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip filter FORWARD tcp dport 22 counter reject with icmp type port-unreachable After this patch: $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip filter FORWARD tcp dport 22 counter reject Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_icmp: Add translation to nftLaura Garcia Liebana2016-03-171-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | Add translation for icmp to nftables. Not supported icmp codes in nftables are: network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing. Examples: $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j ACCEPT nft add rule ip filter INPUT icmp type echo-reply counter accept $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j ACCEPT nft add rule ip filter INPUT icmp type destination-unreachable counter accept $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT nft add rule ip filter INPUT icmp type != destination-unreachable counter accept Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_LOG: Avoid to print the default log level in the translationRoberto García2016-03-121-1/+2
| | | | | | | | | | | | | | | Remove the log level when default is used Before: $ sudo iptables-translate -I INPUT -j LOG nft add rule filter INPUT log level warning After: $ sudo iptables-translate -I INPUT -j LOG nft add rule filter INPUT counter log Signed-off-by: Roberto García <rodanber@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_LOG: Avoid to print the default log level in the translationLaura Garcia Liebana2016-03-101-1/+2
| | | | | | | | | | | | Avoid to print the log level in the translation when the level is the default value. Example: $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 10 -j LOG nft add rule ip filter INPUT icmp type != router-solicitation counter log Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
* iptables/xtables-arp.c: fix typo, wierd vs weirdArturo Borrero2016-03-101-1/+1
| | | | | | | Reported by Debian lintian tool. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions/libxt_rpfilter.man: fix typo, specifiy vs specifyArturo Borrero2016-03-101-1/+1
| | | | | | | Reported by Debian lintian tool. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-translate: pass ipt_entry and ip6t_entry to ->xlate()Pablo Neira Ayuso2016-03-0942-62/+67
| | | | | | | The multiport match needs it, this basically leaves ->xlate() indirection with almost the same interface as ->print(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_icmp6: Add translation to nftLaura Garcia Liebana2016-03-081-0/+66
| | | | | | | | | | | | | | | | | | | | | | | | Add translation for icmpv6 to nftables. Not supported icmp codes in nftables are: no-route, communication-prohibited, beyond-scope, address-unreachable, port-unreachable, failed-policy, reject-route, ttl-zero-during-transit, ttl-zero-during-reassembly, bad-header, unknown-header-type and unknown-option. Examples: $ ip6tables-translate -t filter -A INPUT -m icmp6 --icmpv6-type 1 -j LOG nft add rule ip6 filter INPUT icmpv6 type destination-unreachable counter log level warn $ ip6tables-translate -t filter -A INPUT -m icmp6 --icmpv6-type neighbour-advertisement -j LOG nft add rule ip6 filter INPUT icmpv6 type nd-neighbor-advert counter log level warn $ ip6tables-translate -t filter -A INPUT -m icmp6 ! --icmpv6-type packet-too-big -j LOG nft add rule ip6 filter INPUT icmpv6 type != packet-too-big counter log level warn Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_rt.c: Add translation to nftJanani Ravichandran2016-03-071-0/+35
| | | | | | | | | | | | | | | | | | | | Add translation for rt for options --rt-type, --rt-segsleft and --rt-len. Examples: $ sudo ip6tables-translate -A INPUT -m rt --rt-type 0 -j DROP nft add rule ip6 filter INPUT rt type 0 counter drop $ sudo ip6tables-translate -A INPUT -m rt ! --rt-len 22 -j DROP nft add rule ip6 filter INPUT rt hdrlength != 22 counter drop $ sudo ip6tables-translate -A INPUT -m rt --rt-segsleft 26 -j ACCEPT nft add rule ip6 filter INPUT rt seg-left 26 counter accept The xlate function returns 0 for other options. Signed-off-by: Janani Ravichandran <janani.rvchndrn@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_dccp: Add translation to nftShivani Bhardwaj2016-03-071-0/+92
| | | | | | | | | | | | | | | | | | | | | | | Add translation for dccp to nftables. Full translation of this match awaits the support for --dccp-option. Examples: $ sudo iptables-translate -A INPUT -p dccp -m dccp --sport 100 nft add rule ip filter INPUT dccp sport 100 counter $ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100:200 nft add rule ip filter INPUT dccp dport 100-200 counter $ sudo iptables-translate -A INPUT -p dccp -m dccp ! --dport 100 nft add rule ip filter INPUT dccp dport != 100 counter $ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack} counter Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_sctp: Add translation to nftShivani Bhardwaj2016-03-031-0/+37
| | | | | | | | | | | | | | | | | Add translation for sctp to nftables. Full translation of this match awaits the support for --chunk-types option. Examples: $ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP nft add rule ip filter INPUT sctp dport 80 counter drop $ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT nft add rule ip filter INPUT sctp sport != 80-100 counter accept Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_owner: Add translation to nftShivani Bhardwaj2016-03-031-0/+51
| | | | | | | | | | | | | | | | | | | | Add translation for module owner to nftables. Full translation of this match awaits the support for --socket-exists option. Examples: $ sudo iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT nft add rule ip nat OUTPUT tcp dport 80 skuid 0 counter accept $ sudo iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner --gid-owner 0-10 -j ACCEPT nft add rule ip nat OUTPUT tcp dport 80 skgid 0-10 counter accept $ sudo iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner shivani -j ACCEPT nft add rule ip nat OUTPUT tcp dport 80 skuid != 1000 counter accept Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_mh: Add translation to nftShivani Bhardwaj2016-03-021-0/+21
| | | | | | | | | | | | | | | Add translation for mobility header to nftables. Examples: $ sudo ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT nft add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter accept $ sudo ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT nft add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft-ipv6: Use meta l4proto instead of nexthdrShivani Bhardwaj2016-03-021-1/+1
| | | | | | | | Use meta l4proto in place of nexthdr for ipv6 protocols as it is not necessary that all protocols be next header. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_MASQUERADE: Add translation to nftShivani Bhardwaj2016-03-021-0/+22
| | | | | | | | | | | | | | | | | | Add translation for masquerade to nftables. Examples: $ sudo ip6tables-translate -t nat -A POSTROUTING -j MASQUERADE nft add rule ip6 nat POSTROUTING counter masquerade $ sudo ip6tables-translate -t nat -A POSTROUTING -p tcp -j MASQUERADE --to-ports 10 nft add rule ip6 nat POSTROUTING ip6 nexthdr tcp counter masquerade to :10 $ sudo ip6tables-translate -t nat -A POSTROUTING -p tcp -j MASQUERADE --to-ports 10-20 --random nft add rule ip6 nat POSTROUTING ip6 nexthdr tcp counter masquerade to :10-20 random Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_MASQUERADE: Add translation to nftShivani Bhardwaj2016-03-021-0/+24
| | | | | | | | | | | | | | | | | | Add translation for masquerade to nftables. Examples: $ sudo iptables-translate -t nat -A POSTROUTING -j MASQUERADE nft add rule ip nat POSTROUTING counter masquerade $ sudo iptables-translate -t nat -A POSTROUTING -p tcp -j MASQUERADE --to-ports 10 nft add rule ip nat POSTROUTING ip protocol tcp counter masquerade to :10 $ sudo iptables-translate -t nat -A POSTROUTING -p tcp -j MASQUERADE --to-ports 10-20 --random nft add rule ip nat POSTROUTING ip protocol tcp counter masquerade to :10-20 random Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: extensions: iptables-translate prints extra "nft" after printing ↵Guruswamy Basavaiah2016-03-011-1/+1
| | | | | | | | | | | | | | | | | | | | any error Output of command "./iptables-translate junk" is Bad argument `junk' Try `iptables-translate -h' or 'iptables-translate --help' for more information. nft Output of command "./iptables-translate -B" is iptables-translate v1.6.0: unknown option "-B" Try `iptables-translate -h' or 'iptables-translate --help' for more information. nft nft should have not been printed in both the cases. Moving the printf call after the do_parse function call Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_TCPOPTSTRIP: Fix musl compatibilityLoganaden Velvindron2016-02-291-0/+15
| | | | | | | | | Add missing constants for libxt_TCPOPTSTRIP.c, in case they are not defined. (Original patch from VoidLinux) Signed-off-by: Loganaden Velvindron <logan@hackers.mu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* comment: Add translation to nftShivani Bhardwaj2016-02-295-0/+29
| | | | | | | | | | | | | | Add translation for match comment to nftables. This patch also adds the relevant infrastructure for carrying out the translation. Example: $ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block" nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\" Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_NFQUEUE: Add translation to nftShivani Bhardwaj2016-02-161-1/+57
| | | | | | | | | | | | | | | | | | Add translation for NF queue to nftables. Examples: $ sudo iptables-translate -t nat -A PREROUTING -p tcp --dport 80 -j NFQUEUE --queue-num 30 nft add rule ip nat PREROUTING tcp dport 80 counter queue num 30 $ sudo iptables-translate -A FORWARD -j NFQUEUE --queue-num 0 --queue-bypass -p TCP --sport 80 nft add rule ip filter FORWARD tcp sport 80 counter queue num 0 bypass $ sudo iptables-translate -A FORWARD -j NFQUEUE --queue-bypass -p TCP --sport 80 --queue-balance 0:3 --queue-cpu-fanout nft add rule ip filter FORWARD tcp sport 80 counter queue num 0-3 bypass,fanout Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft-ipv6: Fix ipv6 flagsShivani Bhardwaj2016-02-161-7/+7
| | | | | | | | | | | | Replace the flags with the correct ipv6 flags. Details: Ana found out the bug and submitted the patch, Shivani applied it on the latest tree and compile tested it. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add xt_xlate_add_comment()Pablo Neira Ayuso2016-02-162-15/+27
| | | | | | | This new function allows us to add comments to the nft rule. This can be used to provide a translation for the comment match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: rename xt_buf to xt_xlatePablo Neira Ayuso2016-02-1637-280/+280
| | | | | | | Use a more generic name for this object to prepare the introduction of other translation specific fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: fix leak in xt_buf objectPablo Neira Ayuso2016-02-161-0/+1
| | | | | | Release data area that is allocated by xt_buf_alloc(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_REDIRECT: Add translation to nftShivani Bhardwaj2016-02-161-0/+19
| | | | | | | | | | | | | | | Add translation for REDIRECT target to nftables. Examples: $ sudo ip6tables-translate -t nat -A prerouting -p tcp --dport 80 -j REDIRECT --to-ports 8080 nft add rule ip6 nat prerouting tcp dport 80 counter redirect to 8080 $ sudo ip6tables-translate -t nat -A prerouting -p tcp --dport 80 -j REDIRECT --to-ports 8080 --random nft add rule ip6 nat prerouting tcp dport 80 counter redirect to 8080 random Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_REDIRECT: Add translation to nftShivani Bhardwaj2016-02-161-0/+19
| | | | | | | | | | | | | | | Add translation for target REDIRECT to nftables. Examples: $ sudo iptables-translate -t nat -A prerouting -p tcp --dport 80 -j REDIRECT --to-ports 8080 nft add rule ip nat prerouting tcp dport 80 counter redirect to 8080 $ sudo iptables-translate -t nat -A prerouting -p tcp --dport 80 -j REDIRECT --to-ports 8080 --random nft add rule ip nat prerouting tcp dport 80 counter redirect to 8080 random Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_hl: Add translation to nftShivani Bhardwaj2016-02-161-0/+18
| | | | | | | | | | | | | | | Add translation for hop limit to nftables. Examples: $ sudo ip6tables-translate -t nat -A postrouting -m hl --hl-gt 3 nft add rule ip6 nat postrouting ip6 hoplimit gt 3 counter $ sudo ip6tables-translate -t nat -A postrouting -m hl ! --hl-eq 3 nft add rule ip6 nat postrouting ip6 hoplimit != 3 counter Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_LOG: Add translation to nftShivani Bhardwaj2016-02-161-0/+37
| | | | | | | | | | | | | | | | | | | Add translation for options log-level and log-prefix of LOG target to nftables. Full translation of this target awaits the support for the options log-tcp-sequence, log-tcp-options, log-ip-options, log-uid and log-macdecode in nftables Examples: $ sudo ip6tables-translate -A FORWARD -p tcp -j LOG --log-level debug nft add rule ip6 filter FORWARD ip6 nexthdr tcp counter log level debug $ sudo ip6tables-translate -A FORWARD -p tcp -j LOG --log-prefix "Checking log" nft add rule ip6 filter FORWARD ip6 nexthdr tcp counter log prefix \"Checking log\" level warn Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_LOG: Add translation to nftShivani Bhardwaj2016-02-161-0/+37
| | | | | | | | | | | | | | | | | | | Add translation for options log-level and log-prefix of LOG target to nftables. Full translation of this target awaits the support for the options log-tcp-sequence, log-tcp-options, log-ip-options, log-uid and log-macdecode in nftables. Examples: $ sudo iptables-translate -A FORWARD -p tcp -j LOG --log-level error nft add rule ip filter FORWARD ip protocol tcp counter log level err $ sudo iptables-translate -A FORWARD -p tcp -j LOG --log-prefix "Random prefix" nft add rule ip filter FORWARD ip protocol tcp counter log prefix \"Random prefix\" level warn Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_REJECT: Add translation to nftShivani Bhardwaj2016-02-161-0/+35
| | | | | | | | | | | | | | | Add translation for target REJECT to nftables. Examples: $ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT --reject-with icmp6-reject-route nft add rule ip6 filter FORWARD tcp dport 22 counter reject with icmpv6 type reject-route $ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT --reject-with tcp-reset nft add rule ip6 filter FORWARD tcp dport 22 counter reject with tcp reset Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_ttl: Add translation to nftShivani Bhardwaj2016-02-161-0/+30
| | | | | | | | | | | | | | | Add translation for module ttl to nftables. Examples: $ sudo iptables-translate -A INPUT -m ttl --ttl-eq 3 -j ACCEPT nft add rule ip filter INPUT ip ttl 3 counter accept $ sudo iptables-translate -A INPUT -m ttl --ttl-gt 5 -j ACCEPT nft add rule ip filter INPUT ip ttl gt 5 counter accept Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_ah: Add translation to nftShivani Bhardwaj2016-02-161-0/+27
| | | | | | | | | | | | | | | | | | | | | Add translation for AH to nftables. Examples: $ sudo ip6tables-translate -A INPUT -m ah --ahspi 500 -j DROP nft add rule ip6 filter INPUT ah spi 500 counter drop $ sudo ip6tables-translate -A INPUT -m ah --ahspi 500:550 -j DROP nft add rule ip6 filter INPUT ah spi 500-550 counter drop $ sudo ip6tables-translate -A INPUT -m ah ! --ahlen 120 nft add rule ip6 filter INPUT ah hdrlength != 120 counter $ sudo ip6tables-translate -A INPUT -m ah --ahres nft add rule ip6 filter INPUT ah reserved 1 counter Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_length: Add translation to nftShivani Bhardwaj2016-02-161-0/+16
| | | | | | | | | | | | | | | | | | | | | Add translation for module length to nftables. Examples: $ sudo iptables-translate -A INPUT -p icmp -m length --length 86:0xffff -j DROP nft add rule ip filter INPUT ip protocol icmp meta length 86-65535 counter drop $ sudo iptables-translate -A INPUT -p udp -m length --length :400 nft add rule ip filter INPUT ip protocol udp meta length 0-400 counter $ sudo iptables-translate -A INPUT -p udp -m length --length 40 nft add rule ip filter INPUT ip protocol udp meta length 40 counter $ sudo iptables-translate -A INPUT -p udp -m length ! --length 40 nft add rule ip filter INPUT ip protocol udp meta length != 40 counter Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_SNAT: Add translation to nftShivani Bhardwaj2016-02-161-0/+50
| | | | | | | | | | | | | | | | | | | | | Add translation for SNAT target to nftables. Examples: $ sudo ip6tables-translate -t nat -A postrouting -o eth0 -p tcp -j SNAT --to [fec0::1234]:80 nft add rule ip6 nat postrouting oifname eth0 ip6 nexthdr tcp counter snat fec0::1234 :80 $ sudo ip6tables-translate -t nat -A postrouting -o eth0 -p tcp -j SNAT --to [fec0::1234]:1-20 nft add rule ip6 nat postrouting oifname eth0 ip6 nexthdr tcp counter snat fec0::1234 :1-20 $ sudo ip6tables-translate -t nat -A postrouting -o eth0 -p tcp -j SNAT --to [fec0::1234]:123 --random nft add rule ip6 nat postrouting oifname eth0 ip6 nexthdr tcp counter snat fec0::1234 :123 random $ sudo ip6tables-translate -t nat -A postrouting -o eth0 -p tcp -j SNAT --to [fec0::1234]:123 --random-fully --persistent nft add rule ip6 nat postrouting oifname eth0 ip6 nexthdr tcp counter snat fec0::1234 :123 fully-random,persistent Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_DNAT: Add translation to nftShivani Bhardwaj2016-02-161-0/+44
| | | | | | | | | | | | | | | | | | | | | Add translation for target DNAT to nftables. Examples: $ sudo ip6tables-translate -t nat -A prerouting -i eth1 -p tcp --dport 8080 -j DNAT --to-destination [fec0::1234]:80 nft add rule ip6 nat prerouting iifname eth1 tcp dport 8080 counter dnat fec0::1234 :80 $ sudo ip6tables-translate -t nat -A prerouting -p tcp -j DNAT --to-destination [fec0::1234]:1-20 nft add rule ip6 nat prerouting ip6 nexthdr tcp counter dnat fec0::1234 :1-20 $ sudo ip6tables-translate -t nat -A prerouting -p tcp -j DNAT --to-destination [fec0::1234]:80 --persistent nft add rule ip6 nat prerouting ip6 nexthdr tcp counter dnat fec0::1234 :80 persistent $ sudo ip6tables-translate -t nat -A prerouting -p tcp -j DNAT --to-destination [fec0::1234]:80 --random --persistent nft add rule ip6 nat prerouting ip6 nexthdr tcp counter dnat fec0::1234 :80 random,persistent Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft-ipv6: Replace ip with ip6Shivani Bhardwaj2016-02-161-3/+3
| | | | | | | | Replace ip with ip6 to avoid conflict between the protocols in the results obtained from ip6tables-translate utility. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_DNAT: Add translation to nftShivani Bhardwaj2016-02-161-0/+46
| | | | | | | | | | | | | | | | | | | | | | | | Add translation for target DNAT to nftables. Examples: $ sudo iptables-translate -t nat -A prerouting -p tcp -o eth0 -j DNAT --to-destination 1.2.3.4 nft add rule ip nat prerouting oifname eth0 ip protocol tcp counter dnat 1.2.3.4 $ sudo iptables-translate -t nat -A prerouting -p tcp -d 15.45.23.67 --dport 80 -j DNAT --to-destination 192.168.1.1-192.168.1.10 nft add rule ip nat prerouting ip daddr 15.45.23.67 tcp dport 80 counter dnat 192.168.1.1-192.168.1.10 $ sudo iptables-translate -t nat -A prerouting -p tcp -o eth0 -j DNAT --to-destination 1.2.3.4:1-1023 nft add rule ip nat prerouting oifname eth0 ip protocol tcp counter dnat 1.2.3.4:1-1023 $ sudo iptables-translate -t nat -A prerouting -p tcp -o eth0 -j DNAT --to-destination 1.2.3.4 --random nft add rule ip nat prerouting oifname eth0 ip protocol tcp counter dnat 1.2.3.4 random $ sudo iptables-translate -t nat -A prerouting -p tcp -o eth0 -j DNAT --to-destination 1.2.3.4 --random --persistent nft add rule ip nat prerouting oifname eth0 ip protocol tcp counter dnat 1.2.3.4 random,persistent Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_SNAT: Add translation to nftShivani Bhardwaj2016-02-161-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | Add translation for target SNAT to nftables. Examples: $ sudo iptables-translate -t nat -A postrouting -o eth0 -j SNAT --to 1.2.3.4 nft add rule ip nat postrouting oifname eth0 counter snat 1.2.3.4 $ sudo iptables-translate -t nat -A postrouting -o eth0 -j SNAT --to 1.2.3.4-1.2.3.6 nft add rule ip nat postrouting oifname eth0 counter snat 1.2.3.4-1.2.3.6 $ sudo iptables-translate -t nat -A postrouting -p tcp -o eth0 -j SNAT --to 1.2.3.4:1-1023 nft add rule ip nat postrouting oifname eth0 ip protocol tcp counter snat 1.2.3.4:1-1023 $ sudo iptables-translate -t nat -A postrouting -o eth0 -j SNAT --to 1.2.3.4 --random nft add rule ip nat postrouting oifname eth0 counter snat 1.2.3.4 random $ sudo iptables-translate -t nat -A postrouting -o eth0 -j SNAT --to 1.2.3.4 --random --persistent nft add rule ip nat postrouting oifname eth0 counter snat 1.2.3.4 random,persistent Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_realm: Add translation to nftShivani Bhardwaj2016-02-161-2/+40
| | | | | | | | | | | | | | | | | | Add translation for routing realm to nftables. Examples: $ sudo iptables-translate -A PREROUTING -m realm --realm 4 nft add rule ip filter PREROUTING rtclassid 0x4 counter $ sudo iptables-translate -A PREROUTING -m realm --realm 5/5 nft add rule ip filter PREROUTING rtclassid and 0x5 == 0x5 counter $ sudo iptables-translate -A PREROUTING -m realm ! --realm 50 nft add rule ip filter PREROUTING rtclassid != 0x32 counter Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_REJECT: Add translation to nftShivani Bhardwaj2016-02-161-2/+45
| | | | | | | | | | | | | | | | | | Add translation for target REJECT to nftables. Examples: $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip filter FORWARD tcp dport 22 counter reject with icmp type port-unreachable $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT --reject-with icmp-net-unreachable nft add rule ip filter FORWARD tcp dport 22 counter reject with icmp type net-unreachable $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT --reject-with tcp-reset nft add rule ip filter FORWARD tcp dport 22 counter reject with tcp reset Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_pkttype: Add translation to nftShivani Bhardwaj2016-02-161-0/+37
| | | | | | | | | | | | | | | Add translation for packet type to nftables. Examples: $ sudo iptables-translate -A INPUT -m pkttype --pkt-type broadcast -j DROP nft add rule ip filter INPUT pkttype broadcast counter drop $ sudo iptables-translate -A INPUT -m pkttype ! --pkt-type unicast -j DROP nft add rule ip filter INPUT pkttype != unicast counter drop Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_connmark: Add translation to nftShivani Bhardwaj2016-02-161-1/+46
| | | | | | | | | | | | | | | | | | | | | | | | | Add translation for connmark to nftables. Examples: $ sudo iptables-translate -A INPUT -m connmark --mark 2 -j ACCEPT nft add rule ip filter INPUT ct mark 0x2 counter accept $ sudo iptables-translate -A INPUT -m connmark ! --mark 2 -j ACCEPT nft add rule ip filter INPUT ct mark != 0x2 counter accept $ sudo iptables-translate -A INPUT -m connmark --mark 10/10 -j ACCEPT nft add rule ip filter INPUT ct mark and 0xa == 0xa counter accept $ sudo iptables-translate -A INPUT -m connmark ! --mark 10/10 -j ACCEPT nft add rule ip filter INPUT ct mark and 0xa != 0xa counter accept $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 40 -m connmark --mark 0x40 nft add rule ip mangle PREROUTING tcp dport 40 ct mark 0x40 counter Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_ah: Add translation to nftShivani Bhardwaj2016-02-161-6/+25
| | | | | | | | | | | | | | | | | | Add translation for Authentication Header to nftables. Examples: $ sudo iptables-translate -A INPUT -p 51 -m ah --ahspi 500 -j DROP nft add rule ip filter INPUT ah spi 500 counter drop $ sudo iptables-translate -A INPUT -p 51 -m ah --ahspi 500:600 -j DROP nft add rule ip filter INPUT ah spi 500-600 counter drop $ sudo iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP nft add rule ip filter INPUT ah spi != 50 counter drop Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_cpu: Add translation to nftShivani Bhardwaj2016-02-161-1/+12
| | | | | | | | | | | | | | | Add translation for module cpu to nftables. Examples: $ sudo iptables-translate -A INPUT -p tcp --dport 80 -m cpu --cpu 0 -j ACCEPT nft add rule ip filter INPUT tcp dport 80 cpu 0 counter accept $ sudo iptables-translate -A INPUT -p tcp --dport 80 -m cpu ! --cpu 1 -j ACCEPT nft add rule ip filter INPUT tcp dport 80 cpu != 1 counter accept Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_devgroup: Add translation to nftShivani Bhardwaj2016-02-161-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | Add translation for device group to nftables. Examples: $ sudo iptables-translate -A FORWARD -m devgroup --src-group 0x2 -j ACCEPT nft add rule ip filter FORWARD iifgroup 0x2 counter accept $ sudo iptables-translate -A FORWARD -m devgroup --dst-group 0xc/0xc -j ACCEPT nft add rule ip filter FORWARD oifgroup and 0xc == 0xc counter accept $ sudo iptables-translate -t mangle -A PREROUTING -p tcp --dport 46000 -m devgroup --src-group 23 -j ACCEPT nft add rule ip mangle PREROUTING tcp dport 46000 iifgroup 0x17 counter accept $ sudo iptables-translate -A FORWARD -m devgroup ! --dst-group 0xc/0xc -j ACCEPT nft add rule ip filter FORWARD oifgroup and 0xc != 0xc counter accept $ sudo iptables-translate -A FORWARD -m devgroup ! --src-group 0x2 -j ACCEPT nft add rule ip filter FORWARD iifgroup != 0x2 counter accept Signed-off-by : Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_mark: Fix inversion codeShivani Bhardwaj2016-02-161-8/+18
| | | | | | | | | | | | | | | Fix the code associated with invert flag. Examples: $ sudo iptables-translate -I INPUT -p tcp -m mark ! --mark 0xa/0xa nft insert rule ip filter INPUT ip protocol tcp mark and 0xa != 0xa counter $ sudo iptables-translate -I INPUT -p tcp -m mark ! --mark 0x1 nft insert rule ip filter INPUT ip protocol tcp mark != 0x1 counter Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>