]> git.ipfire.org Git - thirdparty/iptables.git/commitdiff
extensions: libxt_iprange: Add translation to nft
authorShivani Bhardwaj <shivanib134@gmail.com>
Tue, 22 Dec 2015 07:05:20 +0000 (12:35 +0530)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 16 Feb 2016 18:30:22 +0000 (19:30 +0100)
Add translation for iprange to nftables.

Examples:

$ sudo iptables-translate -A INPUT -m iprange --src-range 192.168.25.149-192.168.25.151 -j ACCEPT
nft add rule ip filter INPUT  ip saddr 192.168.25.149-192.168.25.151 counter accept

$ sudo iptables-translate -A INPUT -m iprange --dst-range 192.168.25.149-192.168.25.151 -j ACCEPT
nft add rule ip filter INPUT  ip daddr 192.168.25.149-192.168.25.151 counter accept

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions/libxt_iprange.c

index 2c9ea99266dcda39e7e1b550fd9f54aa9a267dde..9cf6225e691279c735fc0c3f105f51cf4fedbcce 100644 (file)
@@ -104,7 +104,8 @@ static void iprange_parse(struct xt_option_call *cb)
                info->flags |= IPRANGE_SRC;
                if (cb->invert)
                        info->flags |= IPRANGE_SRC_INV;
-               iprange_parse_range(cb->arg, range, NFPROTO_IPV4, "--src-range");
+               iprange_parse_range(cb->arg, range,
+                                   NFPROTO_IPV4, "--src-range");
                info->src.min_ip = range[0].ip;
                info->src.max_ip = range[1].ip;
                break;
@@ -112,7 +113,8 @@ static void iprange_parse(struct xt_option_call *cb)
                info->flags |= IPRANGE_DST;
                if (cb->invert)
                        info->flags |= IPRANGE_DST_INV;
-               iprange_parse_range(cb->arg, range, NFPROTO_IPV4, "--dst-range");
+               iprange_parse_range(cb->arg, range,
+                                   NFPROTO_IPV4, "--dst-range");
                info->dst.min_ip = range[0].ip;
                info->dst.max_ip = range[1].ip;
                break;
@@ -172,7 +174,7 @@ print_iprange(const struct ipt_iprange *range)
 }
 
 static void iprange_print(const void *ip, const struct xt_entry_match *match,
-                          int numeric)
+                         int numeric)
 {
        const struct ipt_iprange_info *info = (const void *)match->data;
 
@@ -192,7 +194,7 @@ static void iprange_print(const void *ip, const struct xt_entry_match *match,
 
 static void
 iprange_mt4_print(const void *ip, const struct xt_entry_match *match,
-                  int numeric)
+                 int numeric)
 {
        const struct xt_iprange_mtinfo *info = (const void *)match->data;
 
@@ -218,7 +220,7 @@ iprange_mt4_print(const void *ip, const struct xt_entry_match *match,
 
 static void
 iprange_mt6_print(const void *ip, const struct xt_entry_match *match,
-                  int numeric)
+                 int numeric)
 {
        const struct xt_iprange_mtinfo *info = (const void *)match->data;
 
@@ -267,13 +269,15 @@ static void iprange_mt4_save(const void *ip, const struct xt_entry_match *match)
        if (info->flags & IPRANGE_SRC) {
                if (info->flags & IPRANGE_SRC_INV)
                        printf(" !");
-               printf(" --src-range %s", xtables_ipaddr_to_numeric(&info->src_min.in));
+               printf(" --src-range %s",
+                      xtables_ipaddr_to_numeric(&info->src_min.in));
                printf("-%s", xtables_ipaddr_to_numeric(&info->src_max.in));
        }
        if (info->flags & IPRANGE_DST) {
                if (info->flags & IPRANGE_DST_INV)
                        printf(" !");
-               printf(" --dst-range %s", xtables_ipaddr_to_numeric(&info->dst_min.in));
+               printf(" --dst-range %s",
+                      xtables_ipaddr_to_numeric(&info->dst_min.in));
                printf("-%s", xtables_ipaddr_to_numeric(&info->dst_max.in));
        }
 }
@@ -285,17 +289,103 @@ static void iprange_mt6_save(const void *ip, const struct xt_entry_match *match)
        if (info->flags & IPRANGE_SRC) {
                if (info->flags & IPRANGE_SRC_INV)
                        printf(" !");
-               printf(" --src-range %s", xtables_ip6addr_to_numeric(&info->src_min.in6));
+               printf(" --src-range %s",
+                      xtables_ip6addr_to_numeric(&info->src_min.in6));
                printf("-%s", xtables_ip6addr_to_numeric(&info->src_max.in6));
        }
        if (info->flags & IPRANGE_DST) {
                if (info->flags & IPRANGE_DST_INV)
                        printf(" !");
-               printf(" --dst-range %s", xtables_ip6addr_to_numeric(&info->dst_min.in6));
+               printf(" --dst-range %s",
+                      xtables_ip6addr_to_numeric(&info->dst_min.in6));
                printf("-%s", xtables_ip6addr_to_numeric(&info->dst_max.in6));
        }
 }
 
+static void
+print_iprange_xlate(const struct ipt_iprange *range,
+                   struct xt_buf *buf)
+{
+       const unsigned char *byte_min, *byte_max;
+
+       byte_min = (const unsigned char *)&range->min_ip;
+       byte_max = (const unsigned char *)&range->max_ip;
+       xt_buf_add(buf, " %u.%u.%u.%u-%u.%u.%u.%u ",
+                  byte_min[0], byte_min[1], byte_min[2], byte_min[3],
+                  byte_max[0], byte_max[1], byte_max[2], byte_max[3]);
+}
+
+static int iprange_xlate(const struct xt_entry_match *match,
+                        struct xt_buf *buf, int numeric)
+{
+       const struct ipt_iprange_info *info = (const void *)match->data;
+
+       if (info->flags & IPRANGE_SRC) {
+               if (info->flags & IPRANGE_SRC_INV)
+                       xt_buf_add(buf, " !=");
+               xt_buf_add(buf, " ip saddr");
+               print_iprange_xlate(&info->src, buf);
+       }
+       if (info->flags & IPRANGE_DST) {
+               if (info->flags & IPRANGE_DST_INV)
+                       xt_buf_add(buf, " !=");
+               xt_buf_add(buf, " ip daddr");
+               print_iprange_xlate(&info->dst, buf);
+       }
+
+       return 1;
+}
+
+static int iprange_mt4_xlate(const struct xt_entry_match *match,
+                            struct xt_buf *buf, int numeric)
+{
+       const struct xt_iprange_mtinfo *info = (const void *)match->data;
+
+       if (info->flags & IPRANGE_SRC) {
+               if (info->flags & IPRANGE_SRC_INV)
+                       xt_buf_add(buf, " !=");
+               xt_buf_add(buf, " ip saddr %s",
+                          xtables_ipaddr_to_numeric(&info->src_min.in));
+               xt_buf_add(buf, "-%s ",
+                          xtables_ipaddr_to_numeric(&info->src_max.in));
+       }
+       if (info->flags & IPRANGE_DST) {
+               if (info->flags & IPRANGE_DST_INV)
+                       xt_buf_add(buf, " !=");
+               xt_buf_add(buf, " ip daddr %s",
+                          xtables_ipaddr_to_numeric(&info->dst_min.in));
+               xt_buf_add(buf, "-%s ",
+                          xtables_ipaddr_to_numeric(&info->dst_max.in));
+       }
+
+       return 1;
+}
+
+static int iprange_mt6_xlate(const struct xt_entry_match *match,
+                            struct xt_buf *buf, int numeric)
+{
+       const struct xt_iprange_mtinfo *info = (const void *)match->data;
+
+       if (info->flags & IPRANGE_SRC) {
+               if (info->flags & IPRANGE_SRC_INV)
+                       xt_buf_add(buf, " !=");
+               xt_buf_add(buf, " ip saddr %s",
+                          xtables_ip6addr_to_numeric(&info->src_min.in6));
+               xt_buf_add(buf, "-%s ",
+                          xtables_ip6addr_to_numeric(&info->src_max.in6));
+       }
+       if (info->flags & IPRANGE_DST) {
+               if (info->flags & IPRANGE_DST_INV)
+                       xt_buf_add(buf, " !=");
+               xt_buf_add(buf, " ip daddr %s",
+                          xtables_ip6addr_to_numeric(&info->dst_min.in6));
+               xt_buf_add(buf, "-%s ",
+                          xtables_ip6addr_to_numeric(&info->dst_max.in6));
+       }
+
+       return 1;
+}
+
 static struct xtables_match iprange_mt_reg[] = {
        {
                .version       = XTABLES_VERSION,
@@ -310,6 +400,7 @@ static struct xtables_match iprange_mt_reg[] = {
                .print         = iprange_print,
                .save          = iprange_save,
                .x6_options    = iprange_mt_opts,
+               .xlate         = iprange_xlate,
        },
        {
                .version       = XTABLES_VERSION,
@@ -324,6 +415,7 @@ static struct xtables_match iprange_mt_reg[] = {
                .print         = iprange_mt4_print,
                .save          = iprange_mt4_save,
                .x6_options    = iprange_mt_opts,
+               .xlate         = iprange_mt4_xlate,
        },
        {
                .version       = XTABLES_VERSION,
@@ -338,6 +430,7 @@ static struct xtables_match iprange_mt_reg[] = {
                .print         = iprange_mt6_print,
                .save          = iprange_mt6_save,
                .x6_options    = iprange_mt_opts,
+               .xlate         = iprange_mt6_xlate,
        },
 };