From 1123e6a069123756c6c73d5557d06bc5fc31497e Mon Sep 17 00:00:00 2001 From: Liping Zhang Date: Sat, 7 Jan 2017 22:26:46 +0800 Subject: extensions: libxt_rpfilter: add translation to nft For example: # iptables-translate -t mangle -A PREROUTING -m rpfilter nft add rule ip mangle PREROUTING fib saddr . iif oif != 0 counter # iptables-translate -t mangle -A PREROUTING -m rpfilter --validmark \ --loose nft add rule ip mangle PREROUTING fib saddr . mark oif != 0 counter # ip6tables-translate -t mangle -A PREROUTING -m rpfilter --validmark \ --invert nft add rule ip6 mangle PREROUTING fib saddr . mark . iif oif 0 counter Finally, when the "--accept-local" option is specified, we can combine with "fib saddr type" to simulate it. But when it is used like this: "-m rpfilter --accept-local", it means "||" relationship, so we cannot translate it to one single nft rule, translation is not supported yet: # iptables-translate -t mangle -A PREROUTING -m rpfilter --accept-local nft # -t mangle -A PREROUTING -m rpfilter --accept-local When "--accpet-local" is combined with "--invert", it means "&&" relationship, so translation can be: # iptables-translate -t mangle -A PREROUTING -m rpfilter \ --accept-local --invert nft add rule ip mangle PREROUTING fib saddr type != local fib saddr \ . iif oif 0 counter Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_rpfilter.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'extensions/libxt_rpfilter.c') diff --git a/extensions/libxt_rpfilter.c b/extensions/libxt_rpfilter.c index 168e703f..d166baa2 100644 --- a/extensions/libxt_rpfilter.c +++ b/extensions/libxt_rpfilter.c @@ -77,6 +77,31 @@ static void rpfilter_save(const void *ip, const struct xt_entry_match *match) return rpfilter_print_prefix(ip, match->data, "--"); } +static int rpfilter_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) +{ + const struct xt_rpfilter_info *info = (void *)params->match->data; + bool invert = info->flags & XT_RPFILTER_INVERT; + + if (info->flags & XT_RPFILTER_ACCEPT_LOCAL) { + if (invert) + xt_xlate_add(xl, "fib saddr type != local "); + else + return 0; + } + + xt_xlate_add(xl, "fib saddr "); + + if (info->flags & XT_RPFILTER_VALID_MARK) + xt_xlate_add(xl, ". mark "); + if (!(info->flags & XT_RPFILTER_LOOSE)) + xt_xlate_add(xl, ". iif "); + + xt_xlate_add(xl, "oif %s0", invert ? "" : "!= "); + + return 1; +} + static struct xtables_match rpfilter_match = { .family = NFPROTO_UNSPEC, .name = "rpfilter", @@ -88,6 +113,7 @@ static struct xtables_match rpfilter_match = { .save = rpfilter_save, .x6_parse = rpfilter_parse, .x6_options = rpfilter_opts, + .xlate = rpfilter_xlate, }; void _init(void) -- cgit v1.2.3