extensions: libxt_udp: add translation to nft
Some examples:
$ sudo iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
add rule ip filter INPUT iifname eth0 udp sport 53 counter accept
$ sudo ./iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP
add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop
$ sudo ./iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept
Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c
index b9f39ee..0b89df4 100644
--- a/extensions/libxt_udp.c
+++ b/extensions/libxt_udp.c
@@ -152,6 +152,42 @@
}
}
+static int udp_xlate(const struct xt_entry_match *match, struct xt_buf *buf,
+ int numeric)
+{
+ const struct xt_udp *udpinfo = (struct xt_udp *)match->data;
+
+ if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) {
+ if (udpinfo->spts[0] != udpinfo->spts[1]) {
+ xt_buf_add(buf,"udp sport %s%u-%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->spts[0], udpinfo->spts[1]);
+ } else {
+ xt_buf_add(buf, "udp sport %s%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->spts[0]);
+ }
+ }
+
+ if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) {
+ if (udpinfo->dpts[0] != udpinfo->dpts[1]) {
+ xt_buf_add(buf,"udp dport %s%u-%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->dpts[0], udpinfo->dpts[1]);
+ } else {
+ xt_buf_add(buf,"udp dport %s%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->dpts[0]);
+ }
+ }
+
+ return 1;
+}
+
static struct xtables_match udp_match = {
.family = NFPROTO_UNSPEC,
.name = "udp",
@@ -164,6 +200,7 @@
.save = udp_save,
.x6_parse = udp_parse,
.x6_options = udp_opts,
+ .xlate = udp_xlate,
};
void
