extensions: libxt_SYNPROXY: add xlate method

This adds translation capabilities when encountering SYNPROXY inside
iptables rules.

Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_SYNPROXY.c b/extensions/libxt_SYNPROXY.c
index 475590eaa55a0bf0328092befe204dbc1b3d0f48..6a0b913e03b5e32d171e1f67a0ee769c34227f55 100644 (file)
--- a/extensions/libxt_SYNPROXY.c
+++ b/extensions/libxt_SYNPROXY.c
@@ -106,6 +106,28 @@ static void SYNPROXY_save(const void *ip, const struct xt_entry_target *target)
                printf(" --ecn");
 }
 
+static int SYNPROXY_xlate(struct xt_xlate *xl,
+                         const struct xt_xlate_tg_params *params)
+{
+       const struct xt_synproxy_info *info =
+               (const struct xt_synproxy_info *)params->target->data;
+
+       xt_xlate_add(xl, "synproxy ");
+
+       if (info->options & XT_SYNPROXY_OPT_SACK_PERM)
+               xt_xlate_add(xl, "sack-perm ");
+       if (info->options & XT_SYNPROXY_OPT_TIMESTAMP)
+               xt_xlate_add(xl, "timestamp ");
+       if (info->options & XT_SYNPROXY_OPT_WSCALE)
+               xt_xlate_add(xl, "wscale %u ", info->wscale);
+       if (info->options & XT_SYNPROXY_OPT_MSS)
+               xt_xlate_add(xl, "mss %u ", info->mss);
+       if (info->options & XT_SYNPROXY_OPT_ECN)
+               xt_xlate_add(xl, "ecn ");
+
+       return 1;
+}
+
 static struct xtables_target synproxy_tg_reg = {
        .family        = NFPROTO_UNSPEC,
        .name          = "SYNPROXY",
@@ -119,6 +141,7 @@ static struct xtables_target synproxy_tg_reg = {
        .x6_parse      = SYNPROXY_parse,
        .x6_fcheck     = SYNPROXY_check,
        .x6_options    = SYNPROXY_opts,
+       .xlate         = SYNPROXY_xlate,
 };
 
 void _init(void)

diff --git a/extensions/libxt_SYNPROXY.txlate b/extensions/libxt_SYNPROXY.txlate
new file mode 100644 (file)
index 0000000..b3de2b2
--- /dev/null
+++ b/extensions/libxt_SYNPROXY.txlate
@@ -0,0 +1,2 @@
+iptables-translate -t mangle -A INPUT -i iifname -p tcp -m tcp --dport 80 -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
+nft add rule ip mangle INPUT iifname "iifname" tcp dport 80 ct state invalid,untracked  counter synproxy sack-perm timestamp wscale 7 mss 1460