[iptables PATCH] extensions: udp: add translation to nft

[iptables PATCH] extensions: udp: add translation to nft

[Ana Rey]

Some examples:

 $ sudo iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
add rule ip filter INPUT iifname eth0 udp sport 53 counter accept

 $ sudo ./iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP
add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop

 $ sudo ./iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept

Sign-off-by: Ana Rey <anarey@gmail.com>
---
 extensions/libxt_udp.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c
index b9f39ee..f3532ef 100644
--- a/extensions/libxt_udp.c
+++ b/extensions/libxt_udp.c
@@ -152,6 +152,39 @@ static void udp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
+static int udp_xlate(const struct xt_entry_match *match, struct xt_buf *buf)
+{
+	const struct xt_udp *udpinfo = (struct xt_udp *)match->data;
+
+	if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) {
+		if (udpinfo->spts[0] != udpinfo->spts[1])
+			xt_buf_add(buf,"udp sport %s%u-%u ",
+				   udpinfo->invflags & XT_UDP_INV_SRCPT ?
+					 "!= ": "",
+				   udpinfo->spts[0], udpinfo->spts[1]);
+		else
+			xt_buf_add(buf, "udp sport %s%u ",
+				   udpinfo->invflags & XT_UDP_INV_SRCPT ?
+					 "!= ": "",
+				   udpinfo->spts[0]);
+	}
+
+	if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) {
+		if (udpinfo->dpts[0]  != udpinfo->dpts[1])
+			xt_buf_add(buf,"udp dport %s%u-%u ",
+				   udpinfo->invflags & XT_UDP_INV_SRCPT ?
+					 "!= ": "",
+				   udpinfo->dpts[0], udpinfo->dpts[1]);
+		else
+			xt_buf_add(buf,"udp dport %s%u ",
+				   udpinfo->invflags & XT_UDP_INV_SRCPT ?
+					 "!= ": "",
+				   udpinfo->dpts[0]);
+	}
+
+	return 1;
+}
+
 static struct xtables_match udp_match = {
 	.family		= NFPROTO_UNSPEC,
 	.name		= "udp",
@@ -164,6 +197,7 @@ static struct xtables_match udp_match = {
 	.save		= udp_save,
 	.x6_parse	= udp_parse,
 	.x6_options	= udp_opts,
+	.xlate		= udp_xlate,
 };
 
 void
-- 
1.9.0

Re: [iptables PATCH] extensions: udp: add translation to nft

[Pablo Neira Ayuso]

On Wed, Apr 16, 2014 at 09:19:40AM +0200, Ana Rey wrote:
> Some examples:
> 
>  $ sudo iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
> add rule ip filter INPUT iifname eth0 udp sport 53 counter accept
> 
>  $ sudo ./iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP
> add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop
> 
>  $ sudo ./iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
> nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept

Applied to the xlate branch of iptables, will merge that branch into
master once we get a significant amount of iptables to nft translations.

Thanks Ana.