From: "Jose M. Guisado Gomez" <guigom@riseup.net>
To: netfilter-devel@vger.kernel.org
Subject: [PATCH iptables] extensions: add libxt_SYNPROXY xlate method
Date: Mon, 30 Sep 2019 19:28:07 +0200 [thread overview]
Message-ID: <20190930172807.5452-1-guigom@riseup.net> (raw)
This adds translation capabilities when encountering SYNPROXY inside
iptables rules.
Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
---
extensions/libxt_SYNPROXY.c | 23 +++++++++++++++++++++++
extensions/libxt_SYNPROXY.txlate | 2 ++
2 files changed, 25 insertions(+)
create mode 100644 extensions/libxt_SYNPROXY.txlate
diff --git a/extensions/libxt_SYNPROXY.c b/extensions/libxt_SYNPROXY.c
index 475590ea..6a0b913e 100644
--- a/extensions/libxt_SYNPROXY.c
+++ b/extensions/libxt_SYNPROXY.c
@@ -106,6 +106,28 @@ static void SYNPROXY_save(const void *ip, const struct xt_entry_target *target)
printf(" --ecn");
}
+static int SYNPROXY_xlate(struct xt_xlate *xl,
+ const struct xt_xlate_tg_params *params)
+{
+ const struct xt_synproxy_info *info =
+ (const struct xt_synproxy_info *)params->target->data;
+
+ xt_xlate_add(xl, "synproxy ");
+
+ if (info->options & XT_SYNPROXY_OPT_SACK_PERM)
+ xt_xlate_add(xl, "sack-perm ");
+ if (info->options & XT_SYNPROXY_OPT_TIMESTAMP)
+ xt_xlate_add(xl, "timestamp ");
+ if (info->options & XT_SYNPROXY_OPT_WSCALE)
+ xt_xlate_add(xl, "wscale %u ", info->wscale);
+ if (info->options & XT_SYNPROXY_OPT_MSS)
+ xt_xlate_add(xl, "mss %u ", info->mss);
+ if (info->options & XT_SYNPROXY_OPT_ECN)
+ xt_xlate_add(xl, "ecn ");
+
+ return 1;
+}
+
static struct xtables_target synproxy_tg_reg = {
.family = NFPROTO_UNSPEC,
.name = "SYNPROXY",
@@ -119,6 +141,7 @@ static struct xtables_target synproxy_tg_reg = {
.x6_parse = SYNPROXY_parse,
.x6_fcheck = SYNPROXY_check,
.x6_options = SYNPROXY_opts,
+ .xlate = SYNPROXY_xlate,
};
void _init(void)
diff --git a/extensions/libxt_SYNPROXY.txlate b/extensions/libxt_SYNPROXY.txlate
new file mode 100644
index 00000000..b347d3b7
--- /dev/null
+++ b/extensions/libxt_SYNPROXY.txlate
@@ -0,0 +1,2 @@
+iptables-translate -t mangle -A INPUT -i iifname -p tcp -m tcp --dport 80 -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
+nft add rule ip mangle INPUT iifname "iifname" tcp dport 80 ct state invalid,untracked counter synproxy sack-perm timestamp wscale 7 mss 1460
--
2.23.0
next reply other threads:[~2019-09-30 22:46 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-30 17:28 Jose M. Guisado Gomez [this message]
2019-10-01 18:27 ` [PATCH iptables] extensions: add libxt_SYNPROXY xlate method Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190930172807.5452-1-guigom@riseup.net \
--to=guigom@riseup.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).