From 04f569ded54a75243b39c125d63a044f5225a99b Mon Sep 17 00:00:00 2001 From: Ana Rey Date: Wed, 16 Apr 2014 09:19:40 +0200 Subject: extensions: libxt_udp: add translation to nft Some examples: $ sudo iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT add rule ip filter INPUT iifname eth0 udp sport 53 counter accept $ sudo ./iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop $ sudo ./iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept Signed-off-by: Ana Rey Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_udp.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) (limited to 'extensions/libxt_udp.c') diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c index b9f39ee4..0b89df4f 100644 --- a/extensions/libxt_udp.c +++ b/extensions/libxt_udp.c @@ -152,6 +152,42 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) } } +static int udp_xlate(const struct xt_entry_match *match, struct xt_buf *buf, + int numeric) +{ + const struct xt_udp *udpinfo = (struct xt_udp *)match->data; + + if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { + if (udpinfo->spts[0] != udpinfo->spts[1]) { + xt_buf_add(buf,"udp sport %s%u-%u ", + udpinfo->invflags & XT_UDP_INV_SRCPT ? + "!= ": "", + udpinfo->spts[0], udpinfo->spts[1]); + } else { + xt_buf_add(buf, "udp sport %s%u ", + udpinfo->invflags & XT_UDP_INV_SRCPT ? + "!= ": "", + udpinfo->spts[0]); + } + } + + if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { + if (udpinfo->dpts[0] != udpinfo->dpts[1]) { + xt_buf_add(buf,"udp dport %s%u-%u ", + udpinfo->invflags & XT_UDP_INV_SRCPT ? + "!= ": "", + udpinfo->dpts[0], udpinfo->dpts[1]); + } else { + xt_buf_add(buf,"udp dport %s%u ", + udpinfo->invflags & XT_UDP_INV_SRCPT ? + "!= ": "", + udpinfo->dpts[0]); + } + } + + return 1; +} + static struct xtables_match udp_match = { .family = NFPROTO_UNSPEC, .name = "udp", @@ -164,6 +200,7 @@ static struct xtables_match udp_match = { .save = udp_save, .x6_parse = udp_parse, .x6_options = udp_opts, + .xlate = udp_xlate, }; void -- cgit v1.2.3