[PATCH] extensions: libxt_sctp: Add translation to nft

[PATCH] extensions: libxt_sctp: Add translation to nft

[Shivani Bhardwaj]

Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types
option.

Examples:

$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop

$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libxt_sctp.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
index 56a4cdf..626e873 100644
--- a/extensions/libxt_sctp.c
+++ b/extensions/libxt_sctp.c
@@ -485,6 +485,39 @@ static void sctp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
+static int sctp_xlate(const struct xt_entry_match *match,
+		      struct xt_xlate *xl, int numeric)
+{
+	const struct xt_sctp_info *einfo =
+		(const struct xt_sctp_info *)match->data;
+
+	xt_xlate_add(xl, "sctp ");
+
+	if (einfo->flags & XT_SCTP_SRC_PORTS) {
+		if (einfo->spts[0] != einfo->spts[1])
+			xt_xlate_add(xl, "sport%s %u-%u ",
+				     einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0], einfo->spts[1]);
+		else
+			xt_xlate_add(xl, "sport%s %u ",
+				     einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
+				     einfo->spts[0]);
+	}
+
+	if (einfo->flags & XT_SCTP_DEST_PORTS) {
+		if (einfo->dpts[0] != einfo->dpts[1])
+			xt_xlate_add(xl, "dport%s %u-%u ",
+				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0], einfo->dpts[1]);
+		else
+			xt_xlate_add(xl, "dport%s %u ",
+				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
+				     einfo->dpts[0]);
+	}
+
+	return 1;
+}
+
 static struct xtables_match sctp_match = {
 	.name		= "sctp",
 	.family		= NFPROTO_UNSPEC,
@@ -497,6 +530,7 @@ static struct xtables_match sctp_match = {
 	.print		= sctp_print,
 	.save		= sctp_save,
 	.extra_opts	= sctp_opts,
+	.xlate		= sctp_xlate,
 };
 
 void _init(void)
-- 
1.9.1

Re: [PATCH] extensions: libxt_sctp: Add translation to nft

[Pablo Neira Ayuso]

On Wed, Mar 02, 2016 at 02:10:56AM +0530, Shivani Bhardwaj wrote:
> Add translation for sctp to nftables.
> Full translation of this match awaits the support for --chunk-types
> option.

Please, keep this documented in the wiki too so we remember there is a
partial translation for this.

> Examples:
> 
> $ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
> nft add rule ip filter INPUT sctp dport 80 counter drop
> 
> $ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
> nft add rule ip filter INPUT sctp sport != 80-100 counter accept

Applied, thanks Shivani.

Re: [PATCH] extensions: libxt_sctp: Add translation to nft

[Pablo Neira Ayuso]

On Wed, Mar 02, 2016 at 12:48:26PM +0100, Pablo Neira Ayuso wrote:
> On Wed, Mar 02, 2016 at 02:10:56AM +0530, Shivani Bhardwaj wrote:
> > Add translation for sctp to nftables.
> > Full translation of this match awaits the support for --chunk-types
> > option.
> 
> Please, keep this documented in the wiki too so we remember there is a
> partial translation for this.
> 
> > Examples:
> > 
> > $ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
> > nft add rule ip filter INPUT sctp dport 80 counter drop
> > 
> > $ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
> > nft add rule ip filter INPUT sctp sport != 80-100 counter accept
> 
> Applied, thanks Shivani.

Sorry, I have to keep this back.

This crazy thing seems to be valid:

        iptables -I INPUT -p sctp -m sctp

and this will be translated as:

        nft add rule filter INPUT ip protocol sctp sctp

Re: [PATCH] extensions: libxt_sctp: Add translation to nft

[Shivani Bhardwaj]

On Wed, Mar 2, 2016 at 5:24 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Mar 02, 2016 at 12:48:26PM +0100, Pablo Neira Ayuso wrote:
>> On Wed, Mar 02, 2016 at 02:10:56AM +0530, Shivani Bhardwaj wrote:
>> > Add translation for sctp to nftables.
>> > Full translation of this match awaits the support for --chunk-types
>> > option.
>>
>> Please, keep this documented in the wiki too so we remember there is a
>> partial translation for this.
>>
>> > Examples:
>> >
>> > $ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
>> > nft add rule ip filter INPUT sctp dport 80 counter drop
>> >
>> > $ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
>> > nft add rule ip filter INPUT sctp sport != 80-100 counter accept
>>
>> Applied, thanks Shivani.
>
> Sorry, I have to keep this back.
>
> This crazy thing seems to be valid:
>
>         iptables -I INPUT -p sctp -m sctp
>
> and this will be translated as:
>
>         nft add rule filter INPUT ip protocol sctp sctp

dmesg shows me

x_tables: ip_tables: sctp match: only valid for protocol 132

means sctp match is valid for sctp protocol. There should not be an
sctp match (correct me if I am wrong here), should this be on
bugzilla?

Re: [PATCH] extensions: libxt_sctp: Add translation to nft

[Jan Engelhardt]

On Wednesday 2016-03-02 15:14, Shivani Bhardwaj wrote:
>>
>> This crazy thing seems to be valid:
>>
>>         iptables -I INPUT -p sctp -m sctp

This is how all protocols are loaded. It can be readily seen
in a iptables-save dump. One tests the L3 header field, the other
loads the module for further options to do tests on L4 fields.

>>
>> and this will be translated as:
>>
>>         nft add rule filter INPUT ip protocol sctp sctp

that seems correct, does it not?
"sctp" is just a shorthand representation for "sctp port 1:65535".

Re: [PATCH] extensions: libxt_sctp: Add translation to nft

[Pablo Neira Ayuso]

On Wed, Mar 02, 2016 at 03:47:32PM +0100, Jan Engelhardt wrote:
> 
> On Wednesday 2016-03-02 15:14, Shivani Bhardwaj wrote:
> >>
> >> This crazy thing seems to be valid:
> >>
> >>         iptables -I INPUT -p sctp -m sctp
> 
> This is how all protocols are loaded. It can be readily seen
> in a iptables-save dump. One tests the L3 header field, the other
> loads the module for further options to do tests on L4 fields.
> 
> >>
> >> and this will be translated as:
> >>
> >>         nft add rule filter INPUT ip protocol sctp sctp
> 
> that seems correct, does it not?

That translation is not correct in nft:

# nft add rule filter INPUT ip protocol sctp sctp
<cmdline>:1:44-44: Error: syntax error, unexpected end of file,
expecting checksum or sport or dport or vtag
add rule filter INPUT ip protocol sctp sctp

Re: [PATCH] extensions: libxt_sctp: Add translation to nft

[Pablo Neira Ayuso]

On Wed, Mar 02, 2016 at 07:44:51PM +0530, Shivani Bhardwaj wrote:
> On Wed, Mar 2, 2016 at 5:24 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Mar 02, 2016 at 12:48:26PM +0100, Pablo Neira Ayuso wrote:
> >> On Wed, Mar 02, 2016 at 02:10:56AM +0530, Shivani Bhardwaj wrote:
> >> > Add translation for sctp to nftables.
> >> > Full translation of this match awaits the support for --chunk-types
> >> > option.
> >>
> >> Please, keep this documented in the wiki too so we remember there is a
> >> partial translation for this.
> >>
> >> > Examples:
> >> >
> >> > $ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
> >> > nft add rule ip filter INPUT sctp dport 80 counter drop
> >> >
> >> > $ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
> >> > nft add rule ip filter INPUT sctp sport != 80-100 counter accept
> >>
> >> Applied, thanks Shivani.
> >
> > Sorry, I have to keep this back.
> >
> > This crazy thing seems to be valid:
> >
> >         iptables -I INPUT -p sctp -m sctp
> >
> > and this will be translated as:
> >
> >         nft add rule filter INPUT ip protocol sctp sctp
> 
> dmesg shows me
> 
> x_tables: ip_tables: sctp match: only valid for protocol 132

This happens when:

        iptables -I INPUT -m sctp

> means sctp match is valid for sctp protocol. There should not be an
> sctp match (correct me if I am wrong here), should this be on
> bugzilla?

What I suggest is this:

        const struct xt_sctp_info *einfo =
               (const struct xt_sctp_info *)match->data;

        if (!einfo->flags) <------
                return 0;

        xt_xlate_add(xl, "sctp ");
        if (einfo->flags & XT_SCTP_SRC_PORTS) {

Just skip if there is not flags set.