extensions: libxt_rpfilter: add translation to nft

For example:
  # iptables-translate -t mangle -A PREROUTING -m rpfilter
  nft add rule ip mangle PREROUTING fib saddr . iif oif != 0 counter

  # iptables-translate -t mangle -A PREROUTING -m rpfilter --validmark \
  --loose
  nft add rule ip mangle PREROUTING fib saddr . mark oif != 0 counter

  # ip6tables-translate -t mangle -A PREROUTING -m rpfilter --validmark \
  --invert
  nft add rule ip6 mangle PREROUTING fib saddr . mark . iif oif 0 counter

Finally, when the "--accept-local" option is specified, we can combine
with "fib saddr type" to simulate it.

But when it is used like this: "-m rpfilter --accept-local", it means "||"
relationship, so we cannot translate it to one single nft rule,
translation is not supported yet:
  # iptables-translate -t mangle -A PREROUTING -m rpfilter --accept-local
  nft # -t mangle -A PREROUTING -m rpfilter --accept-local

When "--accpet-local" is combined with "--invert", it means "&&"
relationship, so translation can be:
  # iptables-translate -t mangle -A PREROUTING -m rpfilter \
  --accept-local --invert
  nft add rule ip mangle PREROUTING fib saddr type != local fib saddr \
  . iif oif 0 counter

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_rpfilter.c b/extensions/libxt_rpfilter.c
index 168e703fa0747304c8980b02afe1aa6a12688ca5..d166baa22f44f1774a32cb989f1e7b11710aebec 100644 (file)
--- a/extensions/libxt_rpfilter.c
+++ b/extensions/libxt_rpfilter.c
@@ -77,6 +77,31 @@ static void rpfilter_save(const void *ip, const struct xt_entry_match *match)
        return rpfilter_print_prefix(ip, match->data, "--");
 }
 
+static int rpfilter_xlate(struct xt_xlate *xl,
+                         const struct xt_xlate_mt_params *params)
+{
+       const struct xt_rpfilter_info *info = (void *)params->match->data;
+       bool invert = info->flags & XT_RPFILTER_INVERT;
+
+       if (info->flags & XT_RPFILTER_ACCEPT_LOCAL) {
+               if (invert)
+                       xt_xlate_add(xl, "fib saddr type != local ");
+               else
+                       return 0;
+       }
+
+       xt_xlate_add(xl, "fib saddr ");
+
+       if (info->flags & XT_RPFILTER_VALID_MARK)
+               xt_xlate_add(xl, ". mark ");
+       if (!(info->flags & XT_RPFILTER_LOOSE))
+               xt_xlate_add(xl, ". iif ");
+
+       xt_xlate_add(xl, "oif %s0", invert ? "" : "!= ");
+
+       return 1;
+}
+
 static struct xtables_match rpfilter_match = {
        .family         = NFPROTO_UNSPEC,
        .name           = "rpfilter",
@@ -88,6 +113,7 @@ static struct xtables_match rpfilter_match = {
        .save           = rpfilter_save,
        .x6_parse       = rpfilter_parse,
        .x6_options     = rpfilter_opts,
+       .xlate          = rpfilter_xlate,
 };
 
 void _init(void)