[v3] extensions: libxt_multiport: Add translation to nft
diff mbox

Message ID 20160531182607.GA17802@sonyv
State Changes Requested
Delegated to: Pablo Neira
Headers show

Commit Message

Laura Garcia Liebana May 31, 2016, 6:26 p.m. UTC
Add translation for multiport to nftables, which it's supported natively.

Examples:

$ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept

$ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport 80-88 counter accept

$ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
---
Changes in v2:
	- Add curley brackets to lists and range of ports.
Changes in v3:
	- Avoid {} in port ranges

 extensions/libxt_multiport.c | 118 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 118 insertions(+)

Comments

Arturo Borrero June 1, 2016, 2:43 p.m. UTC | #1
On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote:
> +static int __multiport_xlate_v1(const void *ip,
> +                               const struct xt_entry_match *match,
> +                               struct xt_xlate *xl, int numeric)
> +{
> +       const struct xt_multiport_v1 *multiinfo
> +               = (const struct xt_multiport_v1 *)match->data;
> +       unsigned int i;
> +
> +       switch (multiinfo->flags) {
> +       case XT_MULTIPORT_SOURCE:
> +               xt_xlate_add(xl, "sport ");
> +               break;
> +       case XT_MULTIPORT_DESTINATION:
> +               xt_xlate_add(xl, "dport ");
> +               break;
> +       case XT_MULTIPORT_EITHER:
> +               return 0;
> +       }
> +
> +       if (multiinfo->invert)
> +               xt_xlate_add(xl, "!= ");
> +
> +       if (multiinfo->count > 2 ||
> +           (multiinfo->count > 1 && !multiinfo->pflags[0])) {
> +               xt_xlate_add(xl, "{ ");
> +               if (multiinfo->invert)
> +                       return 0;
> +       }
> +

I fail to understand this return here

Other than that, the patch looks good.

> +       for (i = 0; i < multiinfo->count; i++) {
> +               xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]);
> +               if (multiinfo->pflags[i])
> +                       xt_xlate_add(xl, "-%u", multiinfo->ports[++i]);
> +       }
> +
> +       if (multiinfo->count > 2 ||
> +           (multiinfo->count > 1 && !multiinfo->pflags[0]))
> +               xt_xlate_add(xl, "}");
> +
> +       xt_xlate_add(xl, " ");
> +
> +       return 1;
> +}

I missed this in previous revisions of your patch:

% iptables -A t -p tcp -m multiport --dports 80:100
% iptables -A t -p tcp -m multiport --dports 80:100,299:444

both rules are valid. This means that avoiding the single-element set
in the port-range case doesn't seems that important, sorry for that.
Laura Garcia Liebana June 1, 2016, 8:16 p.m. UTC | #2
On Wed, Jun 01, 2016 at 04:43:45PM +0200, Arturo Borrero Gonzalez wrote:
> On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote:
> > +static int __multiport_xlate_v1(const void *ip,
> > +                               const struct xt_entry_match *match,
> > +                               struct xt_xlate *xl, int numeric)
> > +{
> > +       const struct xt_multiport_v1 *multiinfo
> > +               = (const struct xt_multiport_v1 *)match->data;
> > +       unsigned int i;
> > +
> > +       switch (multiinfo->flags) {
> > +       case XT_MULTIPORT_SOURCE:
> > +               xt_xlate_add(xl, "sport ");
> > +               break;
> > +       case XT_MULTIPORT_DESTINATION:
> > +               xt_xlate_add(xl, "dport ");
> > +               break;
> > +       case XT_MULTIPORT_EITHER:
> > +               return 0;
> > +       }
> > +
> > +       if (multiinfo->invert)
> > +               xt_xlate_add(xl, "!= ");
> > +
> > +       if (multiinfo->count > 2 ||
> > +           (multiinfo->count > 1 && !multiinfo->pflags[0])) {
> > +               xt_xlate_add(xl, "{ ");
> > +               if (multiinfo->invert)
> > +                       return 0;
> > +       }
> > +
> 
> I fail to understand this return here
> 
> Other than that, the patch looks good.
>

It's only to return a non-translation available for the != {} thing
until is supported in nft.

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira Ayuso June 2, 2016, 10:52 a.m. UTC | #3
On Wed, Jun 01, 2016 at 10:16:18PM +0200, Laura Garcia wrote:
> On Wed, Jun 01, 2016 at 04:43:45PM +0200, Arturo Borrero Gonzalez wrote:
> > On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote:
> > > +static int __multiport_xlate_v1(const void *ip,
> > > +                               const struct xt_entry_match *match,
> > > +                               struct xt_xlate *xl, int numeric)
> > > +{
> > > +       const struct xt_multiport_v1 *multiinfo
> > > +               = (const struct xt_multiport_v1 *)match->data;
> > > +       unsigned int i;
> > > +
> > > +       switch (multiinfo->flags) {
> > > +       case XT_MULTIPORT_SOURCE:
> > > +               xt_xlate_add(xl, "sport ");
> > > +               break;
> > > +       case XT_MULTIPORT_DESTINATION:
> > > +               xt_xlate_add(xl, "dport ");
> > > +               break;
> > > +       case XT_MULTIPORT_EITHER:
> > > +               return 0;
> > > +       }
> > > +
> > > +       if (multiinfo->invert)
> > > +               xt_xlate_add(xl, "!= ");
> > > +
> > > +       if (multiinfo->count > 2 ||
> > > +           (multiinfo->count > 1 && !multiinfo->pflags[0])) {
> > > +               xt_xlate_add(xl, "{ ");
> > > +               if (multiinfo->invert)
> > > +                       return 0;
> > > +       }
> > > +
> > 
> > I fail to understand this return here
> > 
> > Other than that, the patch looks good.
> >
> 
> It's only to return a non-translation available for the != {} thing
> until is supported in nft.

I'd suggest you provide this already given that we'll soon have
support for this in nft.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/extensions/libxt_multiport.c b/extensions/libxt_multiport.c
index 03af5a9..869ce37 100644
--- a/extensions/libxt_multiport.c
+++ b/extensions/libxt_multiport.c
@@ -468,6 +468,120 @@  static void multiport_save6_v1(const void *ip_void,
 	__multiport_save_v1(match, ip->proto);
 }
 
+static int __multiport_xlate(const void *ip, const struct xt_entry_match *match,
+			     struct xt_xlate *xl, int numeric)
+{
+	const struct xt_multiport *multiinfo
+		= (const struct xt_multiport *)match->data;
+	unsigned int i;
+
+	switch (multiinfo->flags) {
+	case XT_MULTIPORT_SOURCE:
+		xt_xlate_add(xl, "sport ");
+		break;
+	case XT_MULTIPORT_DESTINATION:
+		xt_xlate_add(xl, "dport ");
+		break;
+	case XT_MULTIPORT_EITHER:
+		return 0;
+	}
+
+	if (multiinfo->count > 1)
+		xt_xlate_add(xl, "{ ");
+
+	for (i = 0; i < multiinfo->count; i++)
+		xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]);
+
+	if (multiinfo->count > 1)
+		xt_xlate_add(xl, "}");
+
+	xt_xlate_add(xl, " ");
+
+	return 1;
+}
+
+static int multiport_xlate(const void *ip, const struct xt_entry_match *match,
+			   struct xt_xlate *xl, int numeric)
+{
+	uint8_t proto = ((const struct ipt_ip *)ip)->proto;
+
+	xt_xlate_add(xl, "%s ", proto_to_name(proto));
+	return __multiport_xlate(ip, match, xl, numeric);
+}
+
+static int multiport_xlate6(const void *ip, const struct xt_entry_match *match,
+			    struct xt_xlate *xl, int numeric)
+{
+	uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto;
+
+	xt_xlate_add(xl, "%s ", proto_to_name(proto));
+	return __multiport_xlate(ip, match, xl, numeric);
+}
+
+static int __multiport_xlate_v1(const void *ip,
+				const struct xt_entry_match *match,
+				struct xt_xlate *xl, int numeric)
+{
+	const struct xt_multiport_v1 *multiinfo
+		= (const struct xt_multiport_v1 *)match->data;
+	unsigned int i;
+
+	switch (multiinfo->flags) {
+	case XT_MULTIPORT_SOURCE:
+		xt_xlate_add(xl, "sport ");
+		break;
+	case XT_MULTIPORT_DESTINATION:
+		xt_xlate_add(xl, "dport ");
+		break;
+	case XT_MULTIPORT_EITHER:
+		return 0;
+	}
+
+	if (multiinfo->invert)
+		xt_xlate_add(xl, "!= ");
+	
+	if (multiinfo->count > 2 || 
+	    (multiinfo->count > 1 && !multiinfo->pflags[0])) {
+		xt_xlate_add(xl, "{ ");
+		if (multiinfo->invert)
+			return 0;
+	}
+
+	for (i = 0; i < multiinfo->count; i++) {
+		xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]);
+		if (multiinfo->pflags[i])
+			xt_xlate_add(xl, "-%u", multiinfo->ports[++i]);
+	}
+
+	if (multiinfo->count > 2 ||
+	    (multiinfo->count > 1 && !multiinfo->pflags[0]))
+		xt_xlate_add(xl, "}");
+
+	xt_xlate_add(xl, " ");
+
+	return 1;
+}
+
+static int multiport_xlate_v1(const void *ip,
+			      const struct xt_entry_match *match,
+			      struct xt_xlate *xl, int numeric)
+{
+	uint8_t proto = ((const struct ipt_ip *)ip)->proto;
+
+	xt_xlate_add(xl, "%s ", proto_to_name(proto));
+	return __multiport_xlate_v1(ip, match, xl, numeric);
+}
+
+static int multiport_xlate6_v1(const void *ip,
+			       const struct xt_entry_match *match,
+			       struct xt_xlate *xl, int numeric)
+{
+	uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto;
+
+	xt_xlate_add(xl, "%s ", proto_to_name(proto));
+	return __multiport_xlate_v1(ip, match, xl, numeric);
+}
+
 static struct xtables_match multiport_mt_reg[] = {
 	{
 		.family        = NFPROTO_IPV4,
@@ -482,6 +596,7 @@  static struct xtables_match multiport_mt_reg[] = {
 		.print         = multiport_print,
 		.save          = multiport_save,
 		.x6_options    = multiport_opts,
+		.xlate         = multiport_xlate,
 	},
 	{
 		.family        = NFPROTO_IPV6,
@@ -496,6 +611,7 @@  static struct xtables_match multiport_mt_reg[] = {
 		.print         = multiport_print6,
 		.save          = multiport_save6,
 		.x6_options    = multiport_opts,
+		.xlate         = multiport_xlate6,
 	},
 	{
 		.family        = NFPROTO_IPV4,
@@ -510,6 +626,7 @@  static struct xtables_match multiport_mt_reg[] = {
 		.print         = multiport_print_v1,
 		.save          = multiport_save_v1,
 		.x6_options    = multiport_opts,
+		.xlate         = multiport_xlate_v1,
 	},
 	{
 		.family        = NFPROTO_IPV6,
@@ -524,6 +641,7 @@  static struct xtables_match multiport_mt_reg[] = {
 		.print         = multiport_print6_v1,
 		.save          = multiport_save6_v1,
 		.x6_options    = multiport_opts,
+		.xlate         = multiport_xlate6_v1,
 	},
 };