| Message ID | 20160531182607.GA17802@sonyv |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote: > +static int __multiport_xlate_v1(const void *ip, > + const struct xt_entry_match *match, > + struct xt_xlate *xl, int numeric) > +{ > + const struct xt_multiport_v1 *multiinfo > + = (const struct xt_multiport_v1 *)match->data; > + unsigned int i; > + > + switch (multiinfo->flags) { > + case XT_MULTIPORT_SOURCE: > + xt_xlate_add(xl, "sport "); > + break; > + case XT_MULTIPORT_DESTINATION: > + xt_xlate_add(xl, "dport "); > + break; > + case XT_MULTIPORT_EITHER: > + return 0; > + } > + > + if (multiinfo->invert) > + xt_xlate_add(xl, "!= "); > + > + if (multiinfo->count > 2 || > + (multiinfo->count > 1 && !multiinfo->pflags[0])) { > + xt_xlate_add(xl, "{ "); > + if (multiinfo->invert) > + return 0; > + } > + I fail to understand this return here Other than that, the patch looks good. > + for (i = 0; i < multiinfo->count; i++) { > + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]); > + if (multiinfo->pflags[i]) > + xt_xlate_add(xl, "-%u", multiinfo->ports[++i]); > + } > + > + if (multiinfo->count > 2 || > + (multiinfo->count > 1 && !multiinfo->pflags[0])) > + xt_xlate_add(xl, "}"); > + > + xt_xlate_add(xl, " "); > + > + return 1; > +} I missed this in previous revisions of your patch: % iptables -A t -p tcp -m multiport --dports 80:100 % iptables -A t -p tcp -m multiport --dports 80:100,299:444 both rules are valid. This means that avoiding the single-element set in the port-range case doesn't seems that important, sorry for that.
On Wed, Jun 01, 2016 at 04:43:45PM +0200, Arturo Borrero Gonzalez wrote: > On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote: > > +static int __multiport_xlate_v1(const void *ip, > > + const struct xt_entry_match *match, > > + struct xt_xlate *xl, int numeric) > > +{ > > + const struct xt_multiport_v1 *multiinfo > > + = (const struct xt_multiport_v1 *)match->data; > > + unsigned int i; > > + > > + switch (multiinfo->flags) { > > + case XT_MULTIPORT_SOURCE: > > + xt_xlate_add(xl, "sport "); > > + break; > > + case XT_MULTIPORT_DESTINATION: > > + xt_xlate_add(xl, "dport "); > > + break; > > + case XT_MULTIPORT_EITHER: > > + return 0; > > + } > > + > > + if (multiinfo->invert) > > + xt_xlate_add(xl, "!= "); > > + > > + if (multiinfo->count > 2 || > > + (multiinfo->count > 1 && !multiinfo->pflags[0])) { > > + xt_xlate_add(xl, "{ "); > > + if (multiinfo->invert) > > + return 0; > > + } > > + > > I fail to understand this return here > > Other than that, the patch looks good. > It's only to return a non-translation available for the != {} thing until is supported in nft. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Jun 01, 2016 at 10:16:18PM +0200, Laura Garcia wrote: > On Wed, Jun 01, 2016 at 04:43:45PM +0200, Arturo Borrero Gonzalez wrote: > > On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote: > > > +static int __multiport_xlate_v1(const void *ip, > > > + const struct xt_entry_match *match, > > > + struct xt_xlate *xl, int numeric) > > > +{ > > > + const struct xt_multiport_v1 *multiinfo > > > + = (const struct xt_multiport_v1 *)match->data; > > > + unsigned int i; > > > + > > > + switch (multiinfo->flags) { > > > + case XT_MULTIPORT_SOURCE: > > > + xt_xlate_add(xl, "sport "); > > > + break; > > > + case XT_MULTIPORT_DESTINATION: > > > + xt_xlate_add(xl, "dport "); > > > + break; > > > + case XT_MULTIPORT_EITHER: > > > + return 0; > > > + } > > > + > > > + if (multiinfo->invert) > > > + xt_xlate_add(xl, "!= "); > > > + > > > + if (multiinfo->count > 2 || > > > + (multiinfo->count > 1 && !multiinfo->pflags[0])) { > > > + xt_xlate_add(xl, "{ "); > > > + if (multiinfo->invert) > > > + return 0; > > > + } > > > + > > > > I fail to understand this return here > > > > Other than that, the patch looks good. > > > > It's only to return a non-translation available for the != {} thing > until is supported in nft. I'd suggest you provide this already given that we'll soon have support for this in nft. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libxt_multiport.c b/extensions/libxt_multiport.c index 03af5a9..869ce37 100644 --- a/extensions/libxt_multiport.c +++ b/extensions/libxt_multiport.c @@ -468,6 +468,120 @@ static void multiport_save6_v1(const void *ip_void, __multiport_save_v1(match, ip->proto); } +static int __multiport_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_multiport *multiinfo + = (const struct xt_multiport *)match->data; + unsigned int i; + + switch (multiinfo->flags) { + case XT_MULTIPORT_SOURCE: + xt_xlate_add(xl, "sport "); + break; + case XT_MULTIPORT_DESTINATION: + xt_xlate_add(xl, "dport "); + break; + case XT_MULTIPORT_EITHER: + return 0; + } + + if (multiinfo->count > 1) + xt_xlate_add(xl, "{ "); + + for (i = 0; i < multiinfo->count; i++) + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]); + + if (multiinfo->count > 1) + xt_xlate_add(xl, "}"); + + xt_xlate_add(xl, " "); + + return 1; +} + +static int multiport_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ipt_ip *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate(ip, match, xl, numeric); +} + +static int multiport_xlate6(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate(ip, match, xl, numeric); +} + +static int __multiport_xlate_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_multiport_v1 *multiinfo + = (const struct xt_multiport_v1 *)match->data; + unsigned int i; + + switch (multiinfo->flags) { + case XT_MULTIPORT_SOURCE: + xt_xlate_add(xl, "sport "); + break; + case XT_MULTIPORT_DESTINATION: + xt_xlate_add(xl, "dport "); + break; + case XT_MULTIPORT_EITHER: + return 0; + } + + if (multiinfo->invert) + xt_xlate_add(xl, "!= "); + + if (multiinfo->count > 2 || + (multiinfo->count > 1 && !multiinfo->pflags[0])) { + xt_xlate_add(xl, "{ "); + if (multiinfo->invert) + return 0; + } + + for (i = 0; i < multiinfo->count; i++) { + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]); + if (multiinfo->pflags[i]) + xt_xlate_add(xl, "-%u", multiinfo->ports[++i]); + } + + if (multiinfo->count > 2 || + (multiinfo->count > 1 && !multiinfo->pflags[0])) + xt_xlate_add(xl, "}"); + + xt_xlate_add(xl, " "); + + return 1; +} + +static int multiport_xlate_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ipt_ip *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate_v1(ip, match, xl, numeric); +} + +static int multiport_xlate6_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate_v1(ip, match, xl, numeric); +} + static struct xtables_match multiport_mt_reg[] = { { .family = NFPROTO_IPV4, @@ -482,6 +596,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print, .save = multiport_save, .x6_options = multiport_opts, + .xlate = multiport_xlate, }, { .family = NFPROTO_IPV6, @@ -496,6 +611,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print6, .save = multiport_save6, .x6_options = multiport_opts, + .xlate = multiport_xlate6, }, { .family = NFPROTO_IPV4, @@ -510,6 +626,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print_v1, .save = multiport_save_v1, .x6_options = multiport_opts, + .xlate = multiport_xlate_v1, }, { .family = NFPROTO_IPV6, @@ -524,6 +641,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print6_v1, .save = multiport_save6_v1, .x6_options = multiport_opts, + .xlate = multiport_xlate6_v1, }, };
Add translation for multiport to nftables, which it's supported natively. Examples: $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport 80-88 counter accept $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> --- Changes in v2: - Add curley brackets to lists and range of ports. Changes in v3: - Avoid {} in port ranges extensions/libxt_multiport.c | 118 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 118 insertions(+)