From: Liping Zhang <zlpnobody@xxxxxxxxx>
For example:
# iptables-translate -t mangle -A PREROUTING -m rpfilter
nft add rule ip mangle PREROUTING fib saddr . iif oif != 0 counter
# iptables-translate -t mangle -A PREROUTING -m rpfilter --validmark \
--loose
nft add rule ip mangle PREROUTING fib saddr . mark oif != 0 counter
# ip6tables-translate -t mangle -A PREROUTING -m rpfilter --validmark \
--invert
nft add rule ip6 mangle PREROUTING fib saddr . mark . iif oif 0 counter
Finally, when the "--accept-local" option is specified, we can combine
with "fib saddr type" to simulate it.
But when it is used like this: "-m rpfilter --accept-local", it means "||"
relationship, so we cannot translate it to one single nft rule,
translation is not supported yet:
# iptables-translate -t mangle -A PREROUTING -m rpfilter --accept-local
nft # -t mangle -A PREROUTING -m rpfilter --accept-local
When "--accpet-local" is combined with "--invert", it means "&&"
relationship, so translation can be:
# iptables-translate -t mangle -A PREROUTING -m rpfilter \
--accept-local --invert
nft add rule ip mangle PREROUTING fib saddr type != local fib saddr \
. iif oif 0 counter
Signed-off-by: Liping Zhang <zlpnobody@xxxxxxxxx>
---
extensions/libxt_rpfilter.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/extensions/libxt_rpfilter.c b/extensions/libxt_rpfilter.c
index 168e703..d166baa 100644
--- a/extensions/libxt_rpfilter.c
+++ b/extensions/libxt_rpfilter.c
@@ -77,6 +77,31 @@ static void rpfilter_save(const void *ip, const struct xt_entry_match *match)
return rpfilter_print_prefix(ip, match->data, "--");
}
+static int rpfilter_xlate(struct xt_xlate *xl,
+ const struct xt_xlate_mt_params *params)
+{
+ const struct xt_rpfilter_info *info = (void *)params->match->data;
+ bool invert = info->flags & XT_RPFILTER_INVERT;
+
+ if (info->flags & XT_RPFILTER_ACCEPT_LOCAL) {
+ if (invert)
+ xt_xlate_add(xl, "fib saddr type != local ");
+ else
+ return 0;
+ }
+
+ xt_xlate_add(xl, "fib saddr ");
+
+ if (info->flags & XT_RPFILTER_VALID_MARK)
+ xt_xlate_add(xl, ". mark ");
+ if (!(info->flags & XT_RPFILTER_LOOSE))
+ xt_xlate_add(xl, ". iif ");
+
+ xt_xlate_add(xl, "oif %s0", invert ? "" : "!= ");
+
+ return 1;
+}
+
static struct xtables_match rpfilter_match = {
.family = NFPROTO_UNSPEC,
.name = "rpfilter",
@@ -88,6 +113,7 @@ static struct xtables_match rpfilter_match = {
.save = rpfilter_save,
.x6_parse = rpfilter_parse,
.x6_options = rpfilter_opts,
+ .xlate = rpfilter_xlate,
};
void _init(void)
--
2.5.5
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
