From patchwork Thu Jun 2 17:29:26 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: nevola X-Patchwork-Id: 629389 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3rLDk63d4Mz9t6g for ; Fri, 3 Jun 2016 03:29:34 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=xs2rn8bW; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932906AbcFBR3c (ORCPT ); Thu, 2 Jun 2016 13:29:32 -0400 Received: from mail-wm0-f67.google.com ([74.125.82.67]:34691 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932175AbcFBR3c (ORCPT ); Thu, 2 Jun 2016 13:29:32 -0400 Received: by mail-wm0-f67.google.com with SMTP id n184so17060856wmn.1 for ; Thu, 02 Jun 2016 10:29:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:subject:message-id:mime-version:content-disposition :user-agent; bh=bU53+MtuDUXRfLPuyE7xkavCjhRjvlbA2C7dcA6i9DA=; b=xs2rn8bWieXdHQfwjHu4ZnJJBYgjq/l2cFQo32EI2woX4ZvrYGBXnkygvWqL/0KCgy Yr2Nip7N+G4m/o9/at6BVqzqUa8fxcnzovy9G/lPEcPEAXujgkkUhDwnd4n+4n7kMbuh SGeR1062GNLWchq9Prle8Tbj7oMo/IjhpiVGn7F6vnRfVe7UID7amqHThq6iivSEC6IG +iSazSdZjm/xf6huKOEwykeK2h1AuqZrymXBzDdP0n6ohmr5+z3tUxLGH9MXUJrk+/O/ tnRyGJ49duN8Gp73sSnEG/BAw6A00/L7APkbGh8HQCsgnZyGR59ZGL3N08QkjwIeCiEz WXgw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition:user-agent; bh=bU53+MtuDUXRfLPuyE7xkavCjhRjvlbA2C7dcA6i9DA=; b=dCYIcJGEILhnth4+u8cgHsadK24tWZVcG45487bAvFK7CdyISEDOebPmwkrHPMnWnH Df5GiZmo5vRz6bdR23US09DDeUzWuPYA8k4LvbJbCOVV0cyiUFFVLBtsH3qsrAxpWSG+ 8CEQkqJQZ5rRCoI+D4O6pOEQHn9CfE/cLxB70TiTfZB+gkL04eiVHS+mDeKJB8L8trUp BCM3KS7d+CNkj6wA8JJEETF5r4t2cqEO2UaSK335BkPYAGAsdKrvJedxqvKZniYEleVx 6ku5j7P7CKZ0g1HYedyO/OIDTYARnfhrQbahfh+Avb8HN4hzqiVpfyXDSGFJ3McQd3ES t3ew== X-Gm-Message-State: ALyK8tJH1dEA4WT2go+Y4yDOMEwSo2YlXqh3sKV/pmhttve6hlPqLQM/UjbZM5qndTnPYA== X-Received: by 10.28.94.12 with SMTP id s12mr28624677wmb.54.1464888570253; Thu, 02 Jun 2016 10:29:30 -0700 (PDT) Received: from sonyv (5.40.227.236.static.user.ono.com. [5.40.227.236]) by smtp.gmail.com with ESMTPSA id d195sm2251501wmd.12.2016.06.02.10.29.29 for (version=TLS1_2 cipher=AES128-SHA bits=128/128); Thu, 02 Jun 2016 10:29:29 -0700 (PDT) Date: Thu, 2 Jun 2016 19:29:26 +0200 From: Laura Garcia Liebana To: netfilter-devel@vger.kernel.org Subject: [PATCHv4] extensions: libxt_multiport: Add translation to nft Message-ID: <20160602172923.GA24172@sonyv> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Add translation for multiport to nftables, which it's supported natively. Examples: $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport 80-88 counter accept $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept Signed-off-by: Laura Garcia Liebana --- Changes in v4: - Support != {} as already given extensions/libxt_multiport.c | 115 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) diff --git a/extensions/libxt_multiport.c b/extensions/libxt_multiport.c index 03af5a9..9b27260 100644 --- a/extensions/libxt_multiport.c +++ b/extensions/libxt_multiport.c @@ -468,6 +468,117 @@ static void multiport_save6_v1(const void *ip_void, __multiport_save_v1(match, ip->proto); } +static int __multiport_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_multiport *multiinfo + = (const struct xt_multiport *)match->data; + unsigned int i; + + switch (multiinfo->flags) { + case XT_MULTIPORT_SOURCE: + xt_xlate_add(xl, "sport "); + break; + case XT_MULTIPORT_DESTINATION: + xt_xlate_add(xl, "dport "); + break; + case XT_MULTIPORT_EITHER: + return 0; + } + + if (multiinfo->count > 1) + xt_xlate_add(xl, "{ "); + + for (i = 0; i < multiinfo->count; i++) + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]); + + if (multiinfo->count > 1) + xt_xlate_add(xl, "}"); + + xt_xlate_add(xl, " "); + + return 1; +} + +static int multiport_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ipt_ip *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate(ip, match, xl, numeric); +} + +static int multiport_xlate6(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate(ip, match, xl, numeric); +} + +static int __multiport_xlate_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct xt_multiport_v1 *multiinfo + = (const struct xt_multiport_v1 *)match->data; + unsigned int i; + + switch (multiinfo->flags) { + case XT_MULTIPORT_SOURCE: + xt_xlate_add(xl, "sport "); + break; + case XT_MULTIPORT_DESTINATION: + xt_xlate_add(xl, "dport "); + break; + case XT_MULTIPORT_EITHER: + return 0; + } + + if (multiinfo->invert) + xt_xlate_add(xl, "!= "); + + if (multiinfo->count > 2 || + (multiinfo->count > 1 && !multiinfo->pflags[0])) + xt_xlate_add(xl, "{ "); + + for (i = 0; i < multiinfo->count; i++) { + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]); + if (multiinfo->pflags[i]) + xt_xlate_add(xl, "-%u", multiinfo->ports[++i]); + } + + if (multiinfo->count > 2 || + (multiinfo->count > 1 && !multiinfo->pflags[0])) + xt_xlate_add(xl, "}"); + + xt_xlate_add(xl, " "); + + return 1; +} + +static int multiport_xlate_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ipt_ip *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate_v1(ip, match, xl, numeric); +} + +static int multiport_xlate6_v1(const void *ip, + const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto; + + xt_xlate_add(xl, "%s ", proto_to_name(proto)); + return __multiport_xlate_v1(ip, match, xl, numeric); +} + static struct xtables_match multiport_mt_reg[] = { { .family = NFPROTO_IPV4, @@ -482,6 +593,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print, .save = multiport_save, .x6_options = multiport_opts, + .xlate = multiport_xlate, }, { .family = NFPROTO_IPV6, @@ -496,6 +608,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print6, .save = multiport_save6, .x6_options = multiport_opts, + .xlate = multiport_xlate6, }, { .family = NFPROTO_IPV4, @@ -510,6 +623,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print_v1, .save = multiport_save_v1, .x6_options = multiport_opts, + .xlate = multiport_xlate_v1, }, { .family = NFPROTO_IPV6, @@ -524,6 +638,7 @@ static struct xtables_match multiport_mt_reg[] = { .print = multiport_print6_v1, .save = multiport_save6_v1, .x6_options = multiport_opts, + .xlate = multiport_xlate6_v1, }, };