[PATCH iptables] extensions: add libxt_SYNPROXY xlate method

[PATCH iptables] extensions: add libxt_SYNPROXY xlate method

[Jose M. Guisado Gomez]

This adds translation capabilities when encountering SYNPROXY inside
iptables rules.

Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
---
 extensions/libxt_SYNPROXY.c      | 23 +++++++++++++++++++++++
 extensions/libxt_SYNPROXY.txlate |  2 ++
 2 files changed, 25 insertions(+)
 create mode 100644 extensions/libxt_SYNPROXY.txlate

diff --git a/extensions/libxt_SYNPROXY.c b/extensions/libxt_SYNPROXY.c
index 475590ea..6a0b913e 100644
--- a/extensions/libxt_SYNPROXY.c
+++ b/extensions/libxt_SYNPROXY.c
@@ -106,6 +106,28 @@ static void SYNPROXY_save(const void *ip, const struct xt_entry_target *target)
 		printf(" --ecn");
 }
 
+static int SYNPROXY_xlate(struct xt_xlate *xl,
+		          const struct xt_xlate_tg_params *params)
+{
+	const struct xt_synproxy_info *info =
+		(const struct xt_synproxy_info *)params->target->data;
+
+	xt_xlate_add(xl, "synproxy ");
+
+	if (info->options & XT_SYNPROXY_OPT_SACK_PERM)
+		xt_xlate_add(xl, "sack-perm ");
+	if (info->options & XT_SYNPROXY_OPT_TIMESTAMP)
+		xt_xlate_add(xl, "timestamp ");
+	if (info->options & XT_SYNPROXY_OPT_WSCALE)
+		xt_xlate_add(xl, "wscale %u ", info->wscale);
+	if (info->options & XT_SYNPROXY_OPT_MSS)
+		xt_xlate_add(xl, "mss %u ", info->mss);
+	if (info->options & XT_SYNPROXY_OPT_ECN)
+		xt_xlate_add(xl, "ecn ");
+
+	return 1;
+}
+
 static struct xtables_target synproxy_tg_reg = {
 	.family        = NFPROTO_UNSPEC,
 	.name          = "SYNPROXY",
@@ -119,6 +141,7 @@ static struct xtables_target synproxy_tg_reg = {
 	.x6_parse      = SYNPROXY_parse,
 	.x6_fcheck     = SYNPROXY_check,
 	.x6_options    = SYNPROXY_opts,
+	.xlate         = SYNPROXY_xlate,
 };
 
 void _init(void)
diff --git a/extensions/libxt_SYNPROXY.txlate b/extensions/libxt_SYNPROXY.txlate
new file mode 100644
index 00000000..b347d3b7
--- /dev/null
+++ b/extensions/libxt_SYNPROXY.txlate
@@ -0,0 +1,2 @@
+iptables-translate -t mangle -A INPUT -i iifname -p tcp -m tcp --dport 80 -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
+nft add rule ip mangle INPUT iifname "iifname" tcp dport 80 ct state invalid,untracked  counter synproxy sack-perm timestamp wscale 7 mss 1460 
-- 
2.23.0

Re: [PATCH iptables] extensions: add libxt_SYNPROXY xlate method

[Pablo Neira Ayuso]

On Mon, Sep 30, 2019 at 07:28:07PM +0200, Jose M. Guisado Gomez wrote:
> This adds translation capabilities when encountering SYNPROXY inside
> iptables rules.

Applied, thanks.