Some examples:
$ sudo iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
add rule ip filter INPUT iifname eth0 udp sport 53 counter accept
$ sudo ./iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP
add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop
$ sudo ./iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept
Sign-off-by: Ana Rey <anarey@xxxxxxxxx>
---
extensions/libxt_udp.c | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c
index b9f39ee..f3532ef 100644
--- a/extensions/libxt_udp.c
+++ b/extensions/libxt_udp.c
@@ -152,6 +152,39 @@ static void udp_save(const void *ip, const struct xt_entry_match *match)
}
}
+static int udp_xlate(const struct xt_entry_match *match, struct xt_buf *buf)
+{
+ const struct xt_udp *udpinfo = (struct xt_udp *)match->data;
+
+ if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) {
+ if (udpinfo->spts[0] != udpinfo->spts[1])
+ xt_buf_add(buf,"udp sport %s%u-%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->spts[0], udpinfo->spts[1]);
+ else
+ xt_buf_add(buf, "udp sport %s%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->spts[0]);
+ }
+
+ if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) {
+ if (udpinfo->dpts[0] != udpinfo->dpts[1])
+ xt_buf_add(buf,"udp dport %s%u-%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->dpts[0], udpinfo->dpts[1]);
+ else
+ xt_buf_add(buf,"udp dport %s%u ",
+ udpinfo->invflags & XT_UDP_INV_SRCPT ?
+ "!= ": "",
+ udpinfo->dpts[0]);
+ }
+
+ return 1;
+}
+
static struct xtables_match udp_match = {
.family = NFPROTO_UNSPEC,
.name = "udp",
@@ -164,6 +197,7 @@ static struct xtables_match udp_match = {
.save = udp_save,
.x6_parse = udp_parse,
.x6_options = udp_opts,
+ .xlate = udp_xlate,
};
void
--
1.9.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
