* [PATCH v3] extensions: libxt_multiport: Add translation to nft
@ 2016-05-31 18:26 Laura Garcia Liebana
2016-06-01 14:43 ` Arturo Borrero Gonzalez
0 siblings, 1 reply; 4+ messages in thread
From: Laura Garcia Liebana @ 2016-05-31 18:26 UTC (permalink / raw)
To: netfilter-devel
Add translation for multiport to nftables, which it's supported natively.
Examples:
$ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept
$ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport 80-88 counter accept
$ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept
Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
---
Changes in v2:
- Add curley brackets to lists and range of ports.
Changes in v3:
- Avoid {} in port ranges
extensions/libxt_multiport.c | 118 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 118 insertions(+)
diff --git a/extensions/libxt_multiport.c b/extensions/libxt_multiport.c
index 03af5a9..869ce37 100644
--- a/extensions/libxt_multiport.c
+++ b/extensions/libxt_multiport.c
@@ -468,6 +468,120 @@ static void multiport_save6_v1(const void *ip_void,
__multiport_save_v1(match, ip->proto);
}
+static int __multiport_xlate(const void *ip, const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ const struct xt_multiport *multiinfo
+ = (const struct xt_multiport *)match->data;
+ unsigned int i;
+
+ switch (multiinfo->flags) {
+ case XT_MULTIPORT_SOURCE:
+ xt_xlate_add(xl, "sport ");
+ break;
+ case XT_MULTIPORT_DESTINATION:
+ xt_xlate_add(xl, "dport ");
+ break;
+ case XT_MULTIPORT_EITHER:
+ return 0;
+ }
+
+ if (multiinfo->count > 1)
+ xt_xlate_add(xl, "{ ");
+
+ for (i = 0; i < multiinfo->count; i++)
+ xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]);
+
+ if (multiinfo->count > 1)
+ xt_xlate_add(xl, "}");
+
+ xt_xlate_add(xl, " ");
+
+ return 1;
+}
+
+static int multiport_xlate(const void *ip, const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ uint8_t proto = ((const struct ipt_ip *)ip)->proto;
+
+ xt_xlate_add(xl, "%s ", proto_to_name(proto));
+ return __multiport_xlate(ip, match, xl, numeric);
+}
+
+static int multiport_xlate6(const void *ip, const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto;
+
+ xt_xlate_add(xl, "%s ", proto_to_name(proto));
+ return __multiport_xlate(ip, match, xl, numeric);
+}
+
+static int __multiport_xlate_v1(const void *ip,
+ const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ const struct xt_multiport_v1 *multiinfo
+ = (const struct xt_multiport_v1 *)match->data;
+ unsigned int i;
+
+ switch (multiinfo->flags) {
+ case XT_MULTIPORT_SOURCE:
+ xt_xlate_add(xl, "sport ");
+ break;
+ case XT_MULTIPORT_DESTINATION:
+ xt_xlate_add(xl, "dport ");
+ break;
+ case XT_MULTIPORT_EITHER:
+ return 0;
+ }
+
+ if (multiinfo->invert)
+ xt_xlate_add(xl, "!= ");
+
+ if (multiinfo->count > 2 ||
+ (multiinfo->count > 1 && !multiinfo->pflags[0])) {
+ xt_xlate_add(xl, "{ ");
+ if (multiinfo->invert)
+ return 0;
+ }
+
+ for (i = 0; i < multiinfo->count; i++) {
+ xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]);
+ if (multiinfo->pflags[i])
+ xt_xlate_add(xl, "-%u", multiinfo->ports[++i]);
+ }
+
+ if (multiinfo->count > 2 ||
+ (multiinfo->count > 1 && !multiinfo->pflags[0]))
+ xt_xlate_add(xl, "}");
+
+ xt_xlate_add(xl, " ");
+
+ return 1;
+}
+
+static int multiport_xlate_v1(const void *ip,
+ const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ uint8_t proto = ((const struct ipt_ip *)ip)->proto;
+
+ xt_xlate_add(xl, "%s ", proto_to_name(proto));
+ return __multiport_xlate_v1(ip, match, xl, numeric);
+}
+
+static int multiport_xlate6_v1(const void *ip,
+ const struct xt_entry_match *match,
+ struct xt_xlate *xl, int numeric)
+{
+ uint8_t proto = ((const struct ip6t_ip6 *)ip)->proto;
+
+ xt_xlate_add(xl, "%s ", proto_to_name(proto));
+ return __multiport_xlate_v1(ip, match, xl, numeric);
+}
+
static struct xtables_match multiport_mt_reg[] = {
{
.family = NFPROTO_IPV4,
@@ -482,6 +596,7 @@ static struct xtables_match multiport_mt_reg[] = {
.print = multiport_print,
.save = multiport_save,
.x6_options = multiport_opts,
+ .xlate = multiport_xlate,
},
{
.family = NFPROTO_IPV6,
@@ -496,6 +611,7 @@ static struct xtables_match multiport_mt_reg[] = {
.print = multiport_print6,
.save = multiport_save6,
.x6_options = multiport_opts,
+ .xlate = multiport_xlate6,
},
{
.family = NFPROTO_IPV4,
@@ -510,6 +626,7 @@ static struct xtables_match multiport_mt_reg[] = {
.print = multiport_print_v1,
.save = multiport_save_v1,
.x6_options = multiport_opts,
+ .xlate = multiport_xlate_v1,
},
{
.family = NFPROTO_IPV6,
@@ -524,6 +641,7 @@ static struct xtables_match multiport_mt_reg[] = {
.print = multiport_print6_v1,
.save = multiport_save6_v1,
.x6_options = multiport_opts,
+ .xlate = multiport_xlate6_v1,
},
};
--
2.7.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v3] extensions: libxt_multiport: Add translation to nft
2016-05-31 18:26 [PATCH v3] extensions: libxt_multiport: Add translation to nft Laura Garcia Liebana
@ 2016-06-01 14:43 ` Arturo Borrero Gonzalez
2016-06-01 20:16 ` Laura Garcia
0 siblings, 1 reply; 4+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-06-01 14:43 UTC (permalink / raw)
To: Laura Garcia Liebana; +Cc: Netfilter Development Mailing list
On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote:
> +static int __multiport_xlate_v1(const void *ip,
> + const struct xt_entry_match *match,
> + struct xt_xlate *xl, int numeric)
> +{
> + const struct xt_multiport_v1 *multiinfo
> + = (const struct xt_multiport_v1 *)match->data;
> + unsigned int i;
> +
> + switch (multiinfo->flags) {
> + case XT_MULTIPORT_SOURCE:
> + xt_xlate_add(xl, "sport ");
> + break;
> + case XT_MULTIPORT_DESTINATION:
> + xt_xlate_add(xl, "dport ");
> + break;
> + case XT_MULTIPORT_EITHER:
> + return 0;
> + }
> +
> + if (multiinfo->invert)
> + xt_xlate_add(xl, "!= ");
> +
> + if (multiinfo->count > 2 ||
> + (multiinfo->count > 1 && !multiinfo->pflags[0])) {
> + xt_xlate_add(xl, "{ ");
> + if (multiinfo->invert)
> + return 0;
> + }
> +
I fail to understand this return here
Other than that, the patch looks good.
> + for (i = 0; i < multiinfo->count; i++) {
> + xt_xlate_add(xl, "%s%u", i ? "," : "", multiinfo->ports[i]);
> + if (multiinfo->pflags[i])
> + xt_xlate_add(xl, "-%u", multiinfo->ports[++i]);
> + }
> +
> + if (multiinfo->count > 2 ||
> + (multiinfo->count > 1 && !multiinfo->pflags[0]))
> + xt_xlate_add(xl, "}");
> +
> + xt_xlate_add(xl, " ");
> +
> + return 1;
> +}
I missed this in previous revisions of your patch:
% iptables -A t -p tcp -m multiport --dports 80:100
% iptables -A t -p tcp -m multiport --dports 80:100,299:444
both rules are valid. This means that avoiding the single-element set
in the port-range case doesn't seems that important, sorry for that.
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] extensions: libxt_multiport: Add translation to nft
2016-06-01 14:43 ` Arturo Borrero Gonzalez
@ 2016-06-01 20:16 ` Laura Garcia
2016-06-02 10:52 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Laura Garcia @ 2016-06-01 20:16 UTC (permalink / raw)
To: Arturo Borrero Gonzalez; +Cc: Netfilter Development Mailing list
On Wed, Jun 01, 2016 at 04:43:45PM +0200, Arturo Borrero Gonzalez wrote:
> On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote:
> > +static int __multiport_xlate_v1(const void *ip,
> > + const struct xt_entry_match *match,
> > + struct xt_xlate *xl, int numeric)
> > +{
> > + const struct xt_multiport_v1 *multiinfo
> > + = (const struct xt_multiport_v1 *)match->data;
> > + unsigned int i;
> > +
> > + switch (multiinfo->flags) {
> > + case XT_MULTIPORT_SOURCE:
> > + xt_xlate_add(xl, "sport ");
> > + break;
> > + case XT_MULTIPORT_DESTINATION:
> > + xt_xlate_add(xl, "dport ");
> > + break;
> > + case XT_MULTIPORT_EITHER:
> > + return 0;
> > + }
> > +
> > + if (multiinfo->invert)
> > + xt_xlate_add(xl, "!= ");
> > +
> > + if (multiinfo->count > 2 ||
> > + (multiinfo->count > 1 && !multiinfo->pflags[0])) {
> > + xt_xlate_add(xl, "{ ");
> > + if (multiinfo->invert)
> > + return 0;
> > + }
> > +
>
> I fail to understand this return here
>
> Other than that, the patch looks good.
>
It's only to return a non-translation available for the != {} thing
until is supported in nft.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] extensions: libxt_multiport: Add translation to nft
2016-06-01 20:16 ` Laura Garcia
@ 2016-06-02 10:52 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2016-06-02 10:52 UTC (permalink / raw)
To: Laura Garcia; +Cc: Arturo Borrero Gonzalez, Netfilter Development Mailing list
On Wed, Jun 01, 2016 at 10:16:18PM +0200, Laura Garcia wrote:
> On Wed, Jun 01, 2016 at 04:43:45PM +0200, Arturo Borrero Gonzalez wrote:
> > On 31 May 2016 at 20:26, Laura Garcia Liebana <nevola@gmail.com> wrote:
> > > +static int __multiport_xlate_v1(const void *ip,
> > > + const struct xt_entry_match *match,
> > > + struct xt_xlate *xl, int numeric)
> > > +{
> > > + const struct xt_multiport_v1 *multiinfo
> > > + = (const struct xt_multiport_v1 *)match->data;
> > > + unsigned int i;
> > > +
> > > + switch (multiinfo->flags) {
> > > + case XT_MULTIPORT_SOURCE:
> > > + xt_xlate_add(xl, "sport ");
> > > + break;
> > > + case XT_MULTIPORT_DESTINATION:
> > > + xt_xlate_add(xl, "dport ");
> > > + break;
> > > + case XT_MULTIPORT_EITHER:
> > > + return 0;
> > > + }
> > > +
> > > + if (multiinfo->invert)
> > > + xt_xlate_add(xl, "!= ");
> > > +
> > > + if (multiinfo->count > 2 ||
> > > + (multiinfo->count > 1 && !multiinfo->pflags[0])) {
> > > + xt_xlate_add(xl, "{ ");
> > > + if (multiinfo->invert)
> > > + return 0;
> > > + }
> > > +
> >
> > I fail to understand this return here
> >
> > Other than that, the patch looks good.
> >
>
> It's only to return a non-translation available for the != {} thing
> until is supported in nft.
I'd suggest you provide this already given that we'll soon have
support for this in nft.
Thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-06-02 10:52 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-05-31 18:26 [PATCH v3] extensions: libxt_multiport: Add translation to nft Laura Garcia Liebana
2016-06-01 14:43 ` Arturo Borrero Gonzalez
2016-06-01 20:16 ` Laura Garcia
2016-06-02 10:52 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.