extensions: libxt_sctp: Add translation to nft

PATCH Superseded Shivani Bhardwaj 2 participants 2 messages Mar 2, 2016 – Mar 3, 2016 netfilter

lore

Share & tools

lore

Shivani Bhardwaj

author

2016-03-02 19:28 UTC #0 lore raw

PATCH v2 1/1 extensions: libxt_sctp: Add translation to nft

Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types option.

Examples:

$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop

$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept

Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v2:
Add code to check if flags is set

 extensions/libxt_sctp.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

extensions/libxt_sctp.c +37 -0

index 56a4cdf..3b0b048 100644
@@ -485,6 +485,42 @@ static void sctp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
+static int sctp_xlate(const struct xt_entry_match *match,
+		      struct xt_xlate *xl, int numeric)
+{
+	const struct xt_sctp_info *einfo =
+		(const struct xt_sctp_info *)match->data;
+
+	if (!einfo->flags)
+		return 0;
+
+	xt_xlate_add(xl, "sctp ");
+
+	if (einfo->flags & XT_SCTP_SRC_PORTS) {
+		if (einfo->spts[0] != einfo->spts[1])
+			xt_xlate_add(xl, "sport%s %u-%u ",
+				     einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0], einfo->spts[1]);
+		else
+			xt_xlate_add(xl, "sport%s %u ",
+				     einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0]);
+	}
+
+	if (einfo->flags & XT_SCTP_DEST_PORTS) {
+		if (einfo->dpts[0] != einfo->dpts[1])
+			xt_xlate_add(xl, "dport%s %u-%u ",
+				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0], einfo->dpts[1]);
+		else
+			xt_xlate_add(xl, "dport%s %u ",
+				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0]);
+	}
+
+	return 1;
+}
+
 static struct xtables_match sctp_match = {
 	.name		= "sctp",
 	.family		= NFPROTO_UNSPEC,

@@ -497,6 +533,7 @@ static struct xtables_match sctp_match = {
 	.print		= sctp_print,
 	.save		= sctp_save,
 	.extra_opts	= sctp_opts,
+	.xlate		= sctp_xlate,
 };
 
 void _init(void)

Signature · 1 line

1.9.1

Pablo Neira Ayuso

maintainer

2016-03-03 12:22 UTC #1 lore raw

Quoted 11 lines · Shivani Bhardwaj

Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types option.
Examples:
$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop
$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept

Also applied, thanks.