extensions: libxt_udp: add translation to nft

Some examples:

 $ sudo iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
add rule ip filter INPUT iifname eth0 udp sport 53 counter accept

 $ sudo ./iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP
add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop

 $ sudo ./iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept

Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c
index b9f39ee4a14348cb546f853f73e19cd3cb928eb8..0b89df4f7410524682eb76b446abdb0c25540d7d 100644 (file)
--- a/extensions/libxt_udp.c
+++ b/extensions/libxt_udp.c
@@ -152,6 +152,42 @@ static void udp_save(const void *ip, const struct xt_entry_match *match)
        }
 }
 
+static int udp_xlate(const struct xt_entry_match *match, struct xt_buf *buf,
+                    int numeric)
+{
+       const struct xt_udp *udpinfo = (struct xt_udp *)match->data;
+
+       if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) {
+               if (udpinfo->spts[0] != udpinfo->spts[1]) {
+                       xt_buf_add(buf,"udp sport %s%u-%u ",
+                                  udpinfo->invflags & XT_UDP_INV_SRCPT ?
+                                        "!= ": "",
+                                  udpinfo->spts[0], udpinfo->spts[1]);
+               } else {
+                       xt_buf_add(buf, "udp sport %s%u ",
+                                  udpinfo->invflags & XT_UDP_INV_SRCPT ?
+                                        "!= ": "",
+                                  udpinfo->spts[0]);
+               }
+       }
+
+       if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) {
+               if (udpinfo->dpts[0]  != udpinfo->dpts[1]) {
+                       xt_buf_add(buf,"udp dport %s%u-%u ",
+                                  udpinfo->invflags & XT_UDP_INV_SRCPT ?
+                                        "!= ": "",
+                                  udpinfo->dpts[0], udpinfo->dpts[1]);
+               } else {
+                       xt_buf_add(buf,"udp dport %s%u ",
+                                  udpinfo->invflags & XT_UDP_INV_SRCPT ?
+                                        "!= ": "",
+                                  udpinfo->dpts[0]);
+               }
+       }
+
+       return 1;
+}
+
 static struct xtables_match udp_match = {
        .family         = NFPROTO_UNSPEC,
        .name           = "udp",
@@ -164,6 +200,7 @@ static struct xtables_match udp_match = {
        .save           = udp_save,
        .x6_parse       = udp_parse,
        .x6_options     = udp_opts,
+       .xlate          = udp_xlate,
 };
 
 void