extensions: libxt_sctp: Add translation to nft

PATCH Applied Shivani Bhardwaj 3 participants 7 messages Mar 1, 2016 – Mar 2, 2016 netfilter

lore

Share & tools

lore

Shivani Bhardwaj

author

2016-03-01 20:41 UTC #0 lore raw

PATCH 1/1 extensions: libxt_sctp: Add translation to nft

Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types option.

Examples:

$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop

$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept

Signed-off-by Shivani Bhardwaj <[email protected]>

---
 extensions/libxt_sctp.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

extensions/libxt_sctp.c +34 -0

index 56a4cdf..626e873 100644
@@ -485,6 +485,39 @@ static void sctp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
+static int sctp_xlate(const struct xt_entry_match *match,
+		      struct xt_xlate *xl, int numeric)
+{
+	const struct xt_sctp_info *einfo =
+		(const struct xt_sctp_info *)match->data;
+
+	xt_xlate_add(xl, "sctp ");
+
+	if (einfo->flags & XT_SCTP_SRC_PORTS) {
+		if (einfo->spts[0] != einfo->spts[1])
+			xt_xlate_add(xl, "sport%s %u-%u ",
+				     einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0], einfo->spts[1]);
+		else
+			xt_xlate_add(xl, "sport%s %u ",
+				     einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0]);
+	}
+
+	if (einfo->flags & XT_SCTP_DEST_PORTS) {
+		if (einfo->dpts[0] != einfo->dpts[1])
+			xt_xlate_add(xl, "dport%s %u-%u ",
+				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0], einfo->dpts[1]);
+		else
+			xt_xlate_add(xl, "dport%s %u ",
+				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0]);
+	}
+
+	return 1;
+}
+
 static struct xtables_match sctp_match = {
 	.name		= "sctp",
 	.family		= NFPROTO_UNSPEC,

@@ -497,6 +530,7 @@ static struct xtables_match sctp_match = {
 	.print		= sctp_print,
 	.save		= sctp_save,
 	.extra_opts	= sctp_opts,
+	.xlate		= sctp_xlate,
 };
 
 void _init(void)

Signature · 1 line

1.9.1

Pablo Neira Ayuso

maintainer Applied

2016-03-02 11:48 UTC #1 lore raw

Quoted 3 lines · Shivani Bhardwaj

Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types option.

Please, keep this documented in the wiki too so we remember there is a partial translation for this.

Quoted 7 lines

Examples:

$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop

$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept

Applied, thanks Shivani.

Pablo Neira Ayuso

maintainer

2016-03-02 11:55 UTC #2 lore raw

Quoted 10 lines · Pablo Neira Ayuso

Quoted 3 lines · Shivani Bhardwaj
Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types option.
Please, keep this documented in the wiki too so we remember there is a partial translation for this.
Quoted 2 lines
Examples:

Quoted 7 lines

Quoted 5 lines

$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop

$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept

Applied, thanks Shivani.

Sorry, I have to keep this back.

This crazy thing seems to be valid:

iptables -I INPUT -p sctp -m sctp

and this will be translated as:

nft add rule filter INPUT ip protocol sctp sctp

Shivani Bhardwaj

author

2016-03-02 14:15 UTC #3 lore raw

Quoted 21 lines · Pablo Neira Ayuso

Quoted 10 lines · Pablo Neira Ayuso
Quoted 3 lines · Shivani Bhardwaj
Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types option.
Please, keep this documented in the wiki too so we remember there is a partial translation for this.
Quoted 2 lines
Examples:
Quoted 7 lines
Quoted 5 lines
$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop
$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept
Applied, thanks Shivani.
Sorry, I have to keep this back.

Quoted 7 lines

This crazy thing seems to be valid:
iptables -I INPUT -p sctp -m sctp
and this will be translated as:
nft add rule filter INPUT ip protocol sctp sctp

dmesg shows me

x_tables: ip_tables: sctp match: only valid for protocol 132

means sctp match is valid for sctp protocol. There should not be an sctp match (correct me if I am wrong here), should this be on bugzilla?

Jan Engelhardt

2016-03-02 14:47 UTC #4 lore raw

Quoted 4 lines · Shivani Bhardwaj

Quoted 4 lines
This crazy thing seems to be valid:
iptables -I INPUT -p sctp -m sctp

This is how all protocols are loaded. It can be readily seen in a iptables-save dump. One tests the L3 header field, the other loads the module for further options to do tests on L4 fields.

Quoted 4 lines

Quoted 4 lines
and this will be translated as:
nft add rule filter INPUT ip protocol sctp sctp

that seems correct, does it not?
"sctp" is just a shorthand representation for "sctp port 1:65535".

Pablo Neira Ayuso

maintainer

2016-03-02 15:10 UTC #5 lore raw

Quoted 12 lines · Jan Engelhardt

Quoted 4 lines · Shivani Bhardwaj
Quoted 4 lines
This crazy thing seems to be valid:
iptables -I INPUT -p sctp -m sctp
This is how all protocols are loaded. It can be readily seen in a iptables-save dump. One tests the L3 header field, the other loads the module for further options to do tests on L4 fields.
Quoted 1 line
Quoted 1 line

Quoted 5 lines

Quoted 3 lines
Quoted 3 lines
and this will be translated as:
nft add rule filter INPUT ip protocol sctp sctp
that seems correct, does it not?

That translation is not correct in nft:

# nft add rule filter INPUT ip protocol sctp sctp
<cmdline>:1:44-44: Error: syntax error, unexpected end of file,
expecting checksum or sport or dport or vtag
add rule filter INPUT ip protocol sctp sctp

Pablo Neira Ayuso

maintainer

2016-03-02 15:20 UTC #6 lore raw

In reply to Shivani Bhardwaj

Quoted 26 lines · Shivani Bhardwaj

Quoted 25 lines · Pablo Neira Ayuso
Quoted 10 lines · Pablo Neira Ayuso
Quoted 3 lines · Shivani Bhardwaj
Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types option.
Please, keep this documented in the wiki too so we remember there is a partial translation for this.
Quoted 2 lines
Examples:
Quoted 7 lines
Quoted 5 lines
$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop
$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept
Applied, thanks Shivani.
Sorry, I have to keep this back.
This crazy thing seems to be valid:
iptables -I INPUT -p sctp -m sctp

Quoted 7 lines

Quoted 3 lines
and this will be translated as:
nft add rule filter INPUT ip protocol sctp sctp
dmesg shows me
x_tables: ip_tables: sctp match: only valid for protocol 132

This happens when:

iptables -I INPUT -m sctp

Quoted 3 lines

means sctp match is valid for sctp protocol. There should not be an sctp match (correct me if I am wrong here), should this be on bugzilla?

What I suggest is this:

        const struct xt_sctp_info *einfo =
               (const struct xt_sctp_info *)match->data;

        if (!einfo->flags) <------
                return 0;

        xt_xlate_add(xl, "sctp ");
        if (einfo->flags & XT_SCTP_SRC_PORTS) {

Just skip if there is not flags set.