extensions: libxt_dccp: Add translation to nft

PATCH In review Shivani Bhardwaj 2 participants 4 messages Mar 3, 2016 – Mar 7, 2016 netfilter

lore

Share & tools

lore

Shivani Bhardwaj

author

2016-03-03 22:01 UTC #0 lore raw

PATCH v3 1/1 extensions: libxt_dccp: Add translation to nft

Add translation for dccp to nftables.

Full translation of this match awaits the support for --dccp-option.

Examples:

$ sudo iptables-translate -A INPUT -p dccp -m dccp --sport 100
nft add rule ip filter INPUT dccp sport 100 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100:200
nft add rule ip filter INPUT dccp dport 100-200 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp ! --dport 100
nft add rule ip filter INPUT dccp dport != 100 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK
nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack} counter

Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v3:
Return 0 if translation for dccp-option is demanded

Changes in v2:
Fix bugs and remove invalid dccp type

Following is not added in commit message as it is not translation code issue:
* Since inversion of set is not possible in nftables, using dccp with rules like
...dccp type != {request, response}..
* dccp type reset
is going to throw errors.

 extensions/libxt_dccp.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 92 insertions(+)

extensions/libxt_dccp.c +92 -0

index a35cabb..0d4f369 100644
@@ -277,6 +277,97 @@ static void dccp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
+static const char *const dccp_pkt_types_xlate[] = {
+	[DCCP_PKT_REQUEST]      = "request",
+	[DCCP_PKT_RESPONSE]     = "response",
+	[DCCP_PKT_DATA]         = "data",
+	[DCCP_PKT_ACK]          = "ack",
+	[DCCP_PKT_DATAACK]      = "dataack",
+	[DCCP_PKT_CLOSEREQ]     = "closereq",
+	[DCCP_PKT_CLOSE]        = "close",
+	[DCCP_PKT_RESET]        = "reset",
+	[DCCP_PKT_SYNC]         = "sync",
+	[DCCP_PKT_SYNCACK]      = "syncack",
+};
+
+static int dccp_type_xlate(const struct xt_dccp_info *einfo,
+			   struct xt_xlate *xl)
+{
+	bool have_type = false, set_need = false;
+	uint16_t types = einfo->typemask;
+
+	if (types & (1 << DCCP_PKT_INVALID))
+		return 0;
+
+	xt_xlate_add(xl, "dccp type%s ", einfo->invflags ? " !=" : "");
+
+	if ((types != 0) && !(types == (types & -types))) {
+		xt_xlate_add(xl, "{");
+		set_need = true;
+	}
+
+	while (types) {
+		unsigned int i;
+
+		for (i = 0; !(types & (1 << i)); i++);
+
+		if (have_type)
+			xt_xlate_add(xl, ", ");
+		else
+			have_type = true;
+
+		xt_xlate_add(xl, "%s", dccp_pkt_types_xlate[i]);
+
+		types &= ~(1 << i);
+	}
+
+	if (set_need)
+		xt_xlate_add(xl, "}");
+
+	xt_xlate_add(xl, " ");
+
+	return 1;
+}
+
+static int dccp_xlate(const struct xt_entry_match *match,
+		      struct xt_xlate *xl, int numeric)
+{
+	const struct xt_dccp_info *einfo =
+			(const struct xt_dccp_info *)match->data;
+	int ret = 1;
+
+	xt_xlate_add(xl, "dccp ");
+
+	if (einfo->flags & XT_DCCP_SRC_PORTS) {
+		if (einfo->spts[0] != einfo->spts[1])
+			xt_xlate_add(xl, "sport%s %u-%u ",
+				     einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0], einfo->spts[1]);
+		else
+			xt_xlate_add(xl, "sport%s %u ",
+				     einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0]);
+	}
+
+	if (einfo->flags & XT_DCCP_DEST_PORTS) {
+		if (einfo->dpts[0] != einfo->dpts[1])
+			xt_xlate_add(xl, "dport%s %u-%u ",
+				     einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0], einfo->dpts[1]);
+		else
+			xt_xlate_add(xl, "dport%s %u ",
+				     einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0]);
+	}
+
+	if (einfo->flags & XT_DCCP_TYPE)
+		ret = dccp_type_xlate(einfo, xl);
+
+	if (einfo->flags & XT_DCCP_OPTION)
+		ret = 0;
+
+	return ret;
+}
 static struct xtables_match dccp_match = {
 	.name		= "dccp",
 	.family		= NFPROTO_UNSPEC,

@@ -288,6 +379,7 @@ static struct xtables_match dccp_match = {
 	.save		= dccp_save,
 	.x6_parse	= dccp_parse,
 	.x6_options	= dccp_opts,
+	.xlate		= dccp_xlate,
 };
 
 void _init(void)

Signature · 1 line

1.9.1

Pablo Neira Ayuso

maintainer

2016-03-07 14:39 UTC #1 lore raw

Quoted 123 lines · Shivani Bhardwaj

Add translation for dccp to nftables.

Full translation of this match awaits the support for --dccp-option.

Examples:

$ sudo iptables-translate -A INPUT -p dccp -m dccp --sport 100
nft add rule ip filter INPUT dccp sport 100 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100:200
nft add rule ip filter INPUT dccp dport 100-200 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp ! --dport 100
nft add rule ip filter INPUT dccp dport != 100 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK
nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack} counter

Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v3:
Return 0 if translation for dccp-option is demanded

Changes in v2:
Fix bugs and remove invalid dccp type

 extensions/libxt_dccp.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 92 insertions(+)

extensions/libxt_dccp.c +78 -0

index a35cabb..0d4f369 100644
@@ -277,6 +277,97 @@ static void dccp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
+static const char *const dccp_pkt_types_xlate[] = {
+	[DCCP_PKT_REQUEST]      = "request",
+	[DCCP_PKT_RESPONSE]     = "response",
+	[DCCP_PKT_DATA]         = "data",
+	[DCCP_PKT_ACK]          = "ack",
+	[DCCP_PKT_DATAACK]      = "dataack",
+	[DCCP_PKT_CLOSEREQ]     = "closereq",
+	[DCCP_PKT_CLOSE]        = "close",
+	[DCCP_PKT_RESET]        = "reset",
+	[DCCP_PKT_SYNC]         = "sync",
+	[DCCP_PKT_SYNCACK]      = "syncack",
+};
+
+static int dccp_type_xlate(const struct xt_dccp_info *einfo,
+			   struct xt_xlate *xl)
+{
+	bool have_type = false, set_need = false;
+	uint16_t types = einfo->typemask;
+
+	if (types & (1 << DCCP_PKT_INVALID))
+		return 0;
+
+	xt_xlate_add(xl, "dccp type%s ", einfo->invflags ? " !=" : "");
+
+	if ((types != 0) && !(types == (types & -types))) {
+		xt_xlate_add(xl, "{");
+		set_need = true;
+	}
+
+	while (types) {
+		unsigned int i;
+
+		for (i = 0; !(types & (1 << i)); i++);
+
+		if (have_type)
+			xt_xlate_add(xl, ", ");
+		else
+			have_type = true;
+
+		xt_xlate_add(xl, "%s", dccp_pkt_types_xlate[i]);
+
+		types &= ~(1 << i);
+	}
+
+	if (set_need)
+		xt_xlate_add(xl, "}");
+
+	xt_xlate_add(xl, " ");
+
+	return 1;
+}
+
+static int dccp_xlate(const struct xt_entry_match *match,
+		      struct xt_xlate *xl, int numeric)
+{
+	const struct xt_dccp_info *einfo =
+			(const struct xt_dccp_info *)match->data;
+	int ret = 1;
+
+	xt_xlate_add(xl, "dccp ");
+
+	if (einfo->flags & XT_DCCP_SRC_PORTS) {
+		if (einfo->spts[0] != einfo->spts[1])
+			xt_xlate_add(xl, "sport%s %u-%u ",
+				     einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0], einfo->spts[1]);
+		else
+			xt_xlate_add(xl, "sport%s %u ",
+				     einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0]);
+	}
+
+	if (einfo->flags & XT_DCCP_DEST_PORTS) {
+		if (einfo->dpts[0] != einfo->dpts[1])
+			xt_xlate_add(xl, "dport%s %u-%u ",
+				     einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0], einfo->dpts[1]);
+		else

extensions/libxt_dccp.c static void dccp_save(const void *ip, const struct xt_entry_match *match) · line 367

Quoted 10 lines

extensions/libxt_dccp.c +10 -0

+			xt_xlate_add(xl, "dport%s %u ",
+				     einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0]);
+	}
+
+	if (einfo->flags & XT_DCCP_TYPE)
+		ret = dccp_type_xlate(einfo, xl);
+
+	if (einfo->flags & XT_DCCP_OPTION)
+		ret = 0;

Shouldn't you check fot this XT_DCCP_OPTION in first place?

Or you achieve the same effect? I don't remember how this is behaving when we already translated many things but just one thing got left behind.

Quoted 21 lines

extensions/libxt_dccp.c +4 -0

+
+	return ret;
+}
 static struct xtables_match dccp_match = {
 	.name		= "dccp",
 	.family		= NFPROTO_UNSPEC,

@@ -288,6 +379,7 @@ static struct xtables_match dccp_match = {
 	.save		= dccp_save,
 	.x6_parse	= dccp_parse,
 	.x6_options	= dccp_opts,
+	.xlate		= dccp_xlate,
 };
 
 void _init(void)

Signature · 6 lines

1.9.1

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Shivani Bhardwaj

author

2016-03-07 16:44 UTC #2 lore raw

Quoted 137 lines · Pablo Neira Ayuso

Quoted 123 lines · Shivani Bhardwaj

Add translation for dccp to nftables.

Full translation of this match awaits the support for --dccp-option.

Examples:

$ sudo iptables-translate -A INPUT -p dccp -m dccp --sport 100
nft add rule ip filter INPUT dccp sport 100 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100:200
nft add rule ip filter INPUT dccp dport 100-200 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp ! --dport 100
nft add rule ip filter INPUT dccp dport != 100 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK
nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack} counter

Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v3:
Return 0 if translation for dccp-option is demanded

Changes in v2:
Fix bugs and remove invalid dccp type

 extensions/libxt_dccp.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 92 insertions(+)

extensions/libxt_dccp.c +78 -0

index a35cabb..0d4f369 100644
@@ -277,6 +277,97 @@ static void dccp_save(const void *ip, const struct xt_entry_match *match)
      }
 }
 
+static const char *const dccp_pkt_types_xlate[] = {
+     [DCCP_PKT_REQUEST]      = "request",
+     [DCCP_PKT_RESPONSE]     = "response",
+     [DCCP_PKT_DATA]         = "data",
+     [DCCP_PKT_ACK]          = "ack",
+     [DCCP_PKT_DATAACK]      = "dataack",
+     [DCCP_PKT_CLOSEREQ]     = "closereq",
+     [DCCP_PKT_CLOSE]        = "close",
+     [DCCP_PKT_RESET]        = "reset",
+     [DCCP_PKT_SYNC]         = "sync",
+     [DCCP_PKT_SYNCACK]      = "syncack",
+};
+
+static int dccp_type_xlate(const struct xt_dccp_info *einfo,
+                        struct xt_xlate *xl)
+{
+     bool have_type = false, set_need = false;
+     uint16_t types = einfo->typemask;
+
+     if (types & (1 << DCCP_PKT_INVALID))
+             return 0;
+
+     xt_xlate_add(xl, "dccp type%s ", einfo->invflags ? " !=" : "");
+
+     if ((types != 0) && !(types == (types & -types))) {
+             xt_xlate_add(xl, "{");
+             set_need = true;
+     }
+
+     while (types) {
+             unsigned int i;
+
+             for (i = 0; !(types & (1 << i)); i++);
+
+             if (have_type)
+                     xt_xlate_add(xl, ", ");
+             else
+                     have_type = true;
+
+             xt_xlate_add(xl, "%s", dccp_pkt_types_xlate[i]);
+
+             types &= ~(1 << i);
+     }
+
+     if (set_need)
+             xt_xlate_add(xl, "}");
+
+     xt_xlate_add(xl, " ");
+
+     return 1;
+}
+
+static int dccp_xlate(const struct xt_entry_match *match,
+                   struct xt_xlate *xl, int numeric)
+{
+     const struct xt_dccp_info *einfo =
+                     (const struct xt_dccp_info *)match->data;
+     int ret = 1;
+
+     xt_xlate_add(xl, "dccp ");
+
+     if (einfo->flags & XT_DCCP_SRC_PORTS) {
+             if (einfo->spts[0] != einfo->spts[1])
+                     xt_xlate_add(xl, "sport%s %u-%u ",
+                                  einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
+                                  einfo->spts[0], einfo->spts[1]);
+             else
+                     xt_xlate_add(xl, "sport%s %u ",
+                                  einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
+                                  einfo->spts[0]);
+     }
+
+     if (einfo->flags & XT_DCCP_DEST_PORTS) {
+             if (einfo->dpts[0] != einfo->dpts[1])
+                     xt_xlate_add(xl, "dport%s %u-%u ",
+                                  einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
+                                  einfo->dpts[0], einfo->dpts[1]);
+             else

extensions/libxt_dccp.c static void dccp_save(const void *ip, const struct xt_entry_match *match) · line 367

Quoted 10 lines

extensions/libxt_dccp.c +10 -0

+                     xt_xlate_add(xl, "dport%s %u ",
+                                  einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
+                                  einfo->dpts[0]);
+     }
+
+     if (einfo->flags & XT_DCCP_TYPE)
+             ret = dccp_type_xlate(einfo, xl);
+
+     if (einfo->flags & XT_DCCP_OPTION)
+             ret = 0;

Shouldn't you check fot this XT_DCCP_OPTION in first place?

Quoted 4 lines

Or you achieve the same effect? I don't remember how this is behaving when we already translated many things but just one thing got left behind.

This gives the same effect.

$ sudo iptables-translate -A INPUT -p dccp -m dccp --sport 100 --dccp-option 1
nft # -A INPUT -p dccp -m dccp --sport 100 --dccp-option 1

Please let me know if you're referring to something else.

Quoted 22 lines

Quoted 22 lines
extensions/libxt_dccp.c +4 -1
+
+     return ret;
+}
 static struct xtables_match dccp_match = {
      .name           = "dccp",
      .family         = NFPROTO_UNSPEC,
@@ -288,6 +379,7 @@ static struct xtables_match dccp_match = {
      .save           = dccp_save,
      .x6_parse       = dccp_parse,
      .x6_options     = dccp_opts,
+     .xlate          = dccp_xlate,
 };
 
 void _init(void)
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Pablo Neira Ayuso

maintainer

2016-03-07 16:51 UTC #3 lore raw

Quoted 142 lines · Shivani Bhardwaj

Quoted 137 lines · Pablo Neira Ayuso

Quoted 123 lines · Shivani Bhardwaj

Add translation for dccp to nftables.

Full translation of this match awaits the support for --dccp-option.

Examples:

$ sudo iptables-translate -A INPUT -p dccp -m dccp --sport 100
nft add rule ip filter INPUT dccp sport 100 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100:200
nft add rule ip filter INPUT dccp dport 100-200 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp ! --dport 100
nft add rule ip filter INPUT dccp dport != 100 counter

$ sudo iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK
nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack} counter

Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v3:
Return 0 if translation for dccp-option is demanded

Changes in v2:
Fix bugs and remove invalid dccp type

 extensions/libxt_dccp.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 92 insertions(+)

extensions/libxt_dccp.c +78 -0

index a35cabb..0d4f369 100644
@@ -277,6 +277,97 @@ static void dccp_save(const void *ip, const struct xt_entry_match *match)
      }
 }
 
+static const char *const dccp_pkt_types_xlate[] = {
+     [DCCP_PKT_REQUEST]      = "request",
+     [DCCP_PKT_RESPONSE]     = "response",
+     [DCCP_PKT_DATA]         = "data",
+     [DCCP_PKT_ACK]          = "ack",
+     [DCCP_PKT_DATAACK]      = "dataack",
+     [DCCP_PKT_CLOSEREQ]     = "closereq",
+     [DCCP_PKT_CLOSE]        = "close",
+     [DCCP_PKT_RESET]        = "reset",
+     [DCCP_PKT_SYNC]         = "sync",
+     [DCCP_PKT_SYNCACK]      = "syncack",
+};
+
+static int dccp_type_xlate(const struct xt_dccp_info *einfo,
+                        struct xt_xlate *xl)
+{
+     bool have_type = false, set_need = false;
+     uint16_t types = einfo->typemask;
+
+     if (types & (1 << DCCP_PKT_INVALID))
+             return 0;
+
+     xt_xlate_add(xl, "dccp type%s ", einfo->invflags ? " !=" : "");
+
+     if ((types != 0) && !(types == (types & -types))) {
+             xt_xlate_add(xl, "{");
+             set_need = true;
+     }
+
+     while (types) {
+             unsigned int i;
+
+             for (i = 0; !(types & (1 << i)); i++);
+
+             if (have_type)
+                     xt_xlate_add(xl, ", ");
+             else
+                     have_type = true;
+
+             xt_xlate_add(xl, "%s", dccp_pkt_types_xlate[i]);
+
+             types &= ~(1 << i);
+     }
+
+     if (set_need)
+             xt_xlate_add(xl, "}");
+
+     xt_xlate_add(xl, " ");
+
+     return 1;
+}
+
+static int dccp_xlate(const struct xt_entry_match *match,
+                   struct xt_xlate *xl, int numeric)
+{
+     const struct xt_dccp_info *einfo =
+                     (const struct xt_dccp_info *)match->data;
+     int ret = 1;
+
+     xt_xlate_add(xl, "dccp ");
+
+     if (einfo->flags & XT_DCCP_SRC_PORTS) {
+             if (einfo->spts[0] != einfo->spts[1])
+                     xt_xlate_add(xl, "sport%s %u-%u ",
+                                  einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
+                                  einfo->spts[0], einfo->spts[1]);
+             else
+                     xt_xlate_add(xl, "sport%s %u ",
+                                  einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
+                                  einfo->spts[0]);
+     }
+
+     if (einfo->flags & XT_DCCP_DEST_PORTS) {
+             if (einfo->dpts[0] != einfo->dpts[1])
+                     xt_xlate_add(xl, "dport%s %u-%u ",
+                                  einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
+                                  einfo->dpts[0], einfo->dpts[1]);
+             else

extensions/libxt_dccp.c static void dccp_save(const void *ip, const struct xt_entry_match *match) · line 367

Quoted 10 lines

extensions/libxt_dccp.c +10 -0

+                     xt_xlate_add(xl, "dport%s %u ",
+                                  einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
+                                  einfo->dpts[0]);
+     }
+
+     if (einfo->flags & XT_DCCP_TYPE)
+             ret = dccp_type_xlate(einfo, xl);
+
+     if (einfo->flags & XT_DCCP_OPTION)
+             ret = 0;

Shouldn't you check fot this XT_DCCP_OPTION in first place?

Quoted 4 lines

Or you achieve the same effect? I don't remember how this is behaving when we already translated many things but just one thing got left behind.

Quoted 6 lines

This gives the same effect.
$ sudo iptables-translate -A INPUT -p dccp -m dccp --sport 100 --dccp-option 1
nft # -A INPUT -p dccp -m dccp --sport 100 --dccp-option 1
Please let me know if you're referring to something else.

That's good then. Applied, thanks.