extensions: libxt_sctp: Add translation to nft

Add translation for sctp to nftables.
Full translation of this match awaits the support for --chunk-types
option.

Examples:

$ sudo iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop

$ sudo iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
index 56a4cdf22939092257d034680e1633e3ceccb0e4..3b0b04864bf805bf16e71c3ae54fd9dae0ae9ea3 100644 (file)
--- a/extensions/libxt_sctp.c
+++ b/extensions/libxt_sctp.c
@@ -485,6 +485,42 @@ static void sctp_save(const void *ip, const struct xt_entry_match *match)
        }
 }
 
+static int sctp_xlate(const struct xt_entry_match *match,
+                     struct xt_xlate *xl, int numeric)
+{
+       const struct xt_sctp_info *einfo =
+               (const struct xt_sctp_info *)match->data;
+
+       if (!einfo->flags)
+               return 0;
+
+       xt_xlate_add(xl, "sctp ");
+
+       if (einfo->flags & XT_SCTP_SRC_PORTS) {
+               if (einfo->spts[0] != einfo->spts[1])
+                       xt_xlate_add(xl, "sport%s %u-%u ",
+                                    einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
+                                    einfo->spts[0], einfo->spts[1]);
+               else
+                       xt_xlate_add(xl, "sport%s %u ",
+                                    einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
+                                    einfo->spts[0]);
+       }
+
+       if (einfo->flags & XT_SCTP_DEST_PORTS) {
+               if (einfo->dpts[0] != einfo->dpts[1])
+                       xt_xlate_add(xl, "dport%s %u-%u ",
+                                    einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
+                                    einfo->dpts[0], einfo->dpts[1]);
+               else
+                       xt_xlate_add(xl, "dport%s %u ",
+                                    einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
+                                    einfo->dpts[0]);
+       }
+
+       return 1;
+}
+
 static struct xtables_match sctp_match = {
        .name           = "sctp",
        .family         = NFPROTO_UNSPEC,
@@ -497,6 +533,7 @@ static struct xtables_match sctp_match = {
        .print          = sctp_print,
        .save           = sctp_save,
        .extra_opts     = sctp_opts,
+       .xlate          = sctp_xlate,
 };
 
 void _init(void)