From patchwork Mon May 30 19:47:51 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: nevola X-Patchwork-Id: 627948 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3rJRxB16lkz9s9Z for ; Tue, 31 May 2016 05:47:58 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=zLhmzSbs; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933443AbcE3Tr5 (ORCPT ); Mon, 30 May 2016 15:47:57 -0400 Received: from mail-wm0-f67.google.com ([74.125.82.67]:34005 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933361AbcE3Tr4 (ORCPT ); Mon, 30 May 2016 15:47:56 -0400 Received: by mail-wm0-f67.google.com with SMTP id n129so25670054wmn.1 for ; Mon, 30 May 2016 12:47:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:subject:message-id:mime-version:content-disposition :user-agent; bh=koiVDbnFtX9uugKTuVeZo85ZWpHX+SCMYAeVVMk3LS0=; b=zLhmzSbsCmKvNEBFKewEnd5NUMoZbzu8VOH3BO4eAg9ndiIoYdzYvl4T0qOju+RTAC QdZ8FDNz+Yz7KwyBxk1A8NyVvKWPsHoJLfoFhtjR4cwTtQKQdFTi5qMY0Xt2b4EH6lWQ 3Sq9av31vseql3KkD0lBzLXoQA+8T1Qww5oC5WSCZ9rJ8lZPger96v4PHdf8otCocT7P wQakJDiZmkUmHB6N3wjksLnw8BGWk/qtPdXcd9TkUAei7ZStYL1nd/VpCcCvWIy/khtj TgfWYsOzqJay5eDfpZBH5chzE6xwHQlI3o5h/Jf+RE/nUpmkRMK7kv1bussO+fyjQXNp xhXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition:user-agent; bh=koiVDbnFtX9uugKTuVeZo85ZWpHX+SCMYAeVVMk3LS0=; b=YVHb5wKPzYczHHd5WOE0cIDqI/i7W9P4Dd7+JGV9K7j3glUUBIT5iu+UndRStdky55 ABEWM6e2tfD/IbamOaB/LyNSqLR4u/Sboe8Zc0fxoGbCdxi9DBdW8eg7hc05/kmREN2y g8vAdHx/DPMejX9kupuCMlb6IhI8SRrS0DZYbWgBL1oqF+rUouhV6Q/2NMfcXKuhdb2/ B8ZE2iLLLGnxRVbLMEx5v+LHox7yMjqHKtQJbV9ZPJjOWeqY4+DroWAwuHU1iPargXja xpcYavaxWdvC3CIPtHfK3KGUE3xAswAN/lamtVNkP5ykijq149lQbXNVbVpKdS29urVe rhnw== X-Gm-Message-State: ALyK8tJ39zYKPSGpec90HzRoY7kV8VDc3WAZAWcQ8BOptSeQR3Y6XdVWt9TeOddOyzKXFg== X-Received: by 10.195.18.99 with SMTP id gl3mr27859091wjd.162.1464637674812; Mon, 30 May 2016 12:47:54 -0700 (PDT) Received: from sonyv ([91.126.73.162]) by smtp.gmail.com with ESMTPSA id r9sm1406837wjc.43.2016.05.30.12.47.53 for (version=TLS1_2 cipher=AES128-SHA bits=128/128); Mon, 30 May 2016 12:47:53 -0700 (PDT) Date: Mon, 30 May 2016 21:47:51 +0200 From: Laura Garcia Liebana To: netfilter-devel@vger.kernel.org Subject: [PATCH v2] extensions: libxt_multiport: Add translation to nft Message-ID: <20160530194748.GA25328@sonyv> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Add translation for multiport to nftables, which it's supported natively. Examples: $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport { 80-88} counter accept $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept Signed-off-by: Laura Garcia Liebana --- Changes in v2: - Add curley brackets to lists and range of ports. extensions/libxt_multiport.c | 116 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 116 insertions(+) diff --git a/extensions/libxt_multiport.c b/extensions/libxt_multiport.c index 03af5a9..25b5589 100644 --- a/extensions/libxt_multiport.c +++ b/extensions/libxt_multiport.c @@ -468,6 +468,118 @@ static void multiport_save6_v1(const void *ip_void, __multiport_save_v1(match, ip->proto); } +static int __multiport_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_multiport *multiinfo + = (const struct xt_multiport *)match->data; + unsigned int i; + + switch (multiinfo->flags) { + case XT_MULTIPORT_SOURCE: + xt_xlate_add(xl, "sport "); + break; + case XT_MULTIPORT_DESTINATION: + xt_xlate_add(xl, "dport "); + break; + case XT_MULTIPORT_EITHER: + return 0; + } + + if (multiinfo->count > 1) + xt_xlate_add(xl, "{ "); + + for (i = 0; i < multiinfo->count; i++) + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]); + + if (multiinfo->count > 1) + xt_xlate_add(xl, "}"); + + xt_xlate_add(xl, " "); + + return 1; +} + +static int multiport_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ipt_ip *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate(ip, match, xl, numeric); +} + +static int multiport_xlate6(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate(ip, match, xl, numeric); +} + +static int __multiport_xlate_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_multiport_v1 *multiinfo + = (const struct xt_multiport_v1 *)match->data; + unsigned int i; + + switch (multiinfo->flags) { + case XT_MULTIPORT_SOURCE: + xt_xlate_add(xl, "sport "); + break; + case XT_MULTIPORT_DESTINATION: + xt_xlate_add(xl, "dport "); + break; + case XT_MULTIPORT_EITHER: + return 0; + } + + if (multiinfo->invert) { + xt_xlate_add(xl, "!= "); + } else { + if (multiinfo->count > 1) + xt_xlate_add(xl, "{ "); + } + + for (i = 0; i < multiinfo->count; i++) { + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]); + if (i && multiinfo->invert) + return 0; + if (multiinfo->pflags[i]) + xt_xlate_add(xl, "-%u", multiinfo->ports[++i]); + } + + if (multiinfo->count > 1 && !multiinfo->invert) + xt_xlate_add(xl, "}"); + + xt_xlate_add(xl, " "); + + return 1; +} + +static int multiport_xlate_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ipt_ip *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate_v1(ip, match, xl, numeric); +} + +static int multiport_xlate6_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate_v1(ip, match, xl, numeric); +} + static struct xtables_match multiport_mt_reg[] = { { .family = NFPROTO_IPV4, @@ -482,6 +594,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print, .save = multiport_save, .x6_options = multiport_opts, + .xlate = multiport_xlate, }, { .family = NFPROTO_IPV6, @@ -496,6 +609,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print6, .save = multiport_save6, .x6_options = multiport_opts, + .xlate = multiport_xlate6, }, { .family = NFPROTO_IPV4, @@ -510,6 +624,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print_v1, .save = multiport_save_v1, .x6_options = multiport_opts, + .xlate = multiport_xlate_v1, }, { .family = NFPROTO_IPV6, @@ -524,6 +639,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print6_v1, .save = multiport_save6_v1, .x6_options = multiport_opts, + .xlate = multiport_xlate6_v1, }, };