Skip to contentSkip to conversation

extensions: libxt_esp: Add translation to nft

PATCH In review Shivani Bhardwaj 2 participants 2 messages Dec 20, 2015 – Dec 22, 2015 netfilter

lore
Share & tools
lore

Shivani Bhardwaj

author
#0 lore raw

PATCH 1/1 extensions: libxt_esp: Add translation to nft

Add translation for ESP Protocol to nftables.

Examples:

$ sudo iptables-translate -A FORWARD -p esp -j ACCEPT
nft add rule ip filter FORWARD ip protocol esp counter accept
$ sudo iptables-translate -A INPUT  --in-interface  wan --protocol esp -j ACCEPT
nft add rule ip filter INPUT iifname wan ip protocol esp counter accept
$ sudo iptables-translate -A INPUT -p 50 -m esp --espspi 500 -j DROP
nft add rule ip filter INPUT  esp spi 500 counter drop
Signed-off-by Shivani Bhardwaj <[email protected]>
---
 extensions/libxt_esp.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)
extensions/libxt_esp.c +21 -2
index 294338b..1c198c6 100644
@@ -79,10 +79,28 @@ static void esp_save(const void *ip, const struct xt_entry_match *match)
 
 }
 
+static int esp_xlate(const struct xt_entry_match *match,
+		     struct xt_buf *buf, int numeric)
+{
+	const struct xt_esp *espinfo = (struct xt_esp *)match->data;
+
+	if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) {
+		xt_buf_add(buf, "%s esp spi ",
+			   (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : "");
+		if (espinfo->spis[0] != espinfo->spis[1])
+			xt_buf_add(buf, "%u:%u ", espinfo->spis[0],
+				   espinfo->spis[1]);
+		else
+			xt_buf_add(buf, "%u ", espinfo->spis[0]);
+	}
+
+	return 1;
+}
+
 static struct xtables_match esp_match = {
 	.family		= NFPROTO_UNSPEC,
-	.name 		= "esp",
-	.version 	= XTABLES_VERSION,
+	.name		= "esp",
+	.version	= XTABLES_VERSION,
 	.size		= XT_ALIGN(sizeof(struct xt_esp)),
 	.userspacesize	= XT_ALIGN(sizeof(struct xt_esp)),
 	.help		= esp_help,

@@ -90,6 +108,7 @@ static struct xtables_match esp_match = {
 	.save		= esp_save,
 	.x6_parse	= esp_parse,
 	.x6_options	= esp_opts,
+	.xlate		= esp_xlate,
 };
 
 void
Signature · 1 line
1.9.1
maintainer
#1 lore raw
Quoted 4 lines · Shivani Bhardwaj

Add translation for ESP Protocol to nftables.

Examples:

Quoted 8 lines
$ sudo iptables-translate -A FORWARD -p esp -j ACCEPT
nft add rule ip filter FORWARD ip protocol esp counter accept
$ sudo iptables-translate -A INPUT  --in-interface  wan --protocol esp -j ACCEPT
nft add rule ip filter INPUT iifname wan ip protocol esp counter accept
$ sudo iptables-translate -A INPUT -p 50 -m esp --espspi 500 -j DROP
nft add rule ip filter INPUT  esp spi 500 counter drop

Applied with changes.

Quoted 10 lines
Signed-off-by Shivani Bhardwaj <[email protected]>
---
 extensions/libxt_esp.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)
extensions/libxt_esp.c +0 -0
index 294338b..1c198c6 100644

extensions/libxt_esp.c static void esp_save(const void *ip, const struct xt_entry_match *match) · line 88

Quoted 10 lines
extensions/libxt_esp.c +7 -0
@@ -79,10 +79,28 @@ static void esp_save(const void *ip, const struct xt_entry_match *match)
 
 }
 
+static int esp_xlate(const struct xt_entry_match *match,
+		     struct xt_buf *buf, int numeric)
+{
+	const struct xt_esp *espinfo = (struct xt_esp *)match->data;
+
+	if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) {
+		xt_buf_add(buf, "%s esp spi ",

This should be "esp spi%s" instead.

extensions/libxt_esp.c static void esp_save(const void *ip, const struct xt_entry_match *match) · line 91

Quoted 3 lines
extensions/libxt_esp.c +3 -0
+			   (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : "");
+		if (espinfo->spis[0] != espinfo->spis[1])
+			xt_buf_add(buf, "%u:%u ", espinfo->spis[0],

This should be "%u-%u".

Please, make sure you test all possible branches in your code next time.

Thanks.