extensions: time: add translation and tests

Translation capabilities for xtables time match. Different time values
(hour and datetime) are translated into ranges.

These time match options can be translated now

	--timestart value
	--timestop value
	[!] --weekdays listofdays
	--datestart date
	--datestop date

The option --monthdays can't be translated into nft as of now.

Examples can be found inside libxt_time.txlate

Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c
index d001f5b7f448f75eb9917b4f71befd8dea42479d..d27d84caf546ee31ad629a9a72564fb0744c6084 100644 (file)
--- a/extensions/libxt_time.c
+++ b/extensions/libxt_time.c
@@ -258,6 +258,16 @@ static unsigned int time_parse_weekdays(const char *arg)
        return ret;
 }
 
+static unsigned int time_count_weekdays(unsigned int weekdays_mask)
+{
+       unsigned int ret;
+
+       for (ret = 0; weekdays_mask; weekdays_mask >>= 1)
+               ret += weekdays_mask & 1;
+
+       return ret;
+}
+
 static void time_parse(struct xt_option_call *cb)
 {
        struct xt_time_info *info = cb->data;
@@ -450,6 +460,67 @@ static void time_check(struct xt_fcheck_call *cb)
                        "time: --contiguous only makes sense when stoptime is smaller than starttime");
 }
 
+static int time_xlate(struct xt_xlate *xl,
+                     const struct xt_xlate_mt_params *params)
+{
+       const struct xt_time_info *info =
+               (const struct xt_time_info *)params->match->data;
+       unsigned int h, m, s,
+                    i, sep, mask, count;
+       time_t tt_start, tt_stop;
+       struct tm *t_start, *t_stop;
+
+       if (info->date_start != 0 ||
+           info->date_stop != INT_MAX) {
+               tt_start = (time_t) info->date_start;
+               tt_stop = (time_t) info->date_stop;
+
+               xt_xlate_add(xl, "meta time ");
+               t_start = gmtime(&tt_start);
+               xt_xlate_add(xl, "\"%04u-%02u-%02u %02u:%02u:%02u\"",
+                            t_start->tm_year + 1900, t_start->tm_mon + 1,
+                            t_start->tm_mday, t_start->tm_hour,
+                            t_start->tm_min, t_start->tm_sec);
+               t_stop = gmtime(&tt_stop);
+               xt_xlate_add(xl, "-\"%04u-%02u-%02u %02u:%02u:%02u\"",
+                            t_stop->tm_year + 1900, t_stop->tm_mon + 1,
+                            t_stop->tm_mday, t_stop->tm_hour,
+                            t_stop->tm_min, t_stop->tm_sec);
+       }
+       if (info->daytime_start != XT_TIME_MIN_DAYTIME ||
+           info->daytime_stop != XT_TIME_MAX_DAYTIME) {
+               divide_time(info->daytime_start, &h, &m, &s);
+               xt_xlate_add(xl, " meta hour \"%02u:%02u:%02u\"", h, m, s);
+               divide_time(info->daytime_stop, &h, &m, &s);
+               xt_xlate_add(xl, "-\"%02u:%02u:%02u\"", h, m, s);
+       }
+       /* nft_time does not support --monthdays */
+       if (info->monthdays_match != XT_TIME_ALL_MONTHDAYS)
+               return 0;
+       if (info->weekdays_match != XT_TIME_ALL_WEEKDAYS) {
+               sep = 0;
+               mask = info->weekdays_match;
+               count = time_count_weekdays(mask);
+
+               xt_xlate_add(xl, " meta day ");
+               if (count > 1)
+                       xt_xlate_add(xl, "{");
+               for (i = 1; i <= 7; ++i)
+                       if (mask & (1 << i)) {
+                               if (sep)
+                                       xt_xlate_add(xl, ",%u", i%7);
+                               else {
+                                       xt_xlate_add(xl, "%u", i%7);
+                                       ++sep;
+                               }
+                       }
+               if (count > 1)
+                       xt_xlate_add(xl, "}");
+       }
+
+       return 1;
+}
+
 static struct xtables_match time_match = {
        .name          = "time",
        .family        = NFPROTO_UNSPEC,
@@ -463,6 +534,7 @@ static struct xtables_match time_match = {
        .x6_parse      = time_parse,
        .x6_fcheck     = time_check,
        .x6_options    = time_opts,
+       .xlate         = time_xlate,
 };
 
 void _init(void)

diff --git a/extensions/libxt_time.txlate b/extensions/libxt_time.txlate
new file mode 100644 (file)
index 0000000..ff4a7b8
--- /dev/null
+++ b/extensions/libxt_time.txlate
@@ -0,0 +1,26 @@
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --weekdays Sa,Su -j REJECT
+nft add rule ip filter INPUT icmp type echo-request  meta day {6,0} counter reject
+
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --timestart 12:00 -j REJECT
+nft add rule ip filter INPUT icmp type echo-request  meta hour "12:00:00"-"23:59:59" counter reject
+
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --timestop 12:00 -j REJECT
+nft add rule ip filter INPUT icmp type echo-request  meta hour "00:00:00"-"12:00:00" counter reject
+
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --datestart 2021 -j REJECT
+nft add rule ip filter INPUT icmp type echo-request meta time "2021-01-01 00:00:00"-"2038-01-19 03:14:07" counter reject
+
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --datestop 2021 -j REJECT
+nft add rule ip filter INPUT icmp type echo-request meta time "1970-01-01 00:00:00"-"2021-01-01 00:00:00" counter reject
+
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --datestop 2021-01-29T00:00:00 -j REJECT
+nft add rule ip filter INPUT icmp type echo-request meta time "1970-01-01 00:00:00"-"2021-01-29 00:00:00" counter reject
+
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --datestart 2020-01-29T00:00:00 --timestart 12:00 -j REJECT
+nft add rule ip filter INPUT icmp type echo-request meta time "2020-01-29 00:00:00"-"2038-01-19 03:14:07" meta hour "12:00:00"-"23:59:59" counter reject
+
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --datestart 2020-01-29T00:00:00 --timestart 12:00 --timestop 19:00 --weekdays Mon,Tue,Wed,Thu,Fri -j REJECT
+nft add rule ip filter INPUT icmp type echo-request meta time "2020-01-29 00:00:00"-"2038-01-19 03:14:07" meta hour "12:00:00"-"19:00:00" meta day {1,2,3,4,5} counter reject
+
+iptables-translate -A INPUT -p icmp --icmp-type echo-request -m time --datestart 2020-01-29T00:00:00 --timestart 12:00 --timestop 19:00 ! --weekdays Mon,Tue,Wed,Thu,Fri -j REJECT
+nft add rule ip filter INPUT icmp type echo-request meta time "2020-01-29 00:00:00"-"2038-01-19 03:14:07" meta hour "12:00:00"-"19:00:00" meta day {6,0} counter reject