Signed-off-by: Florian Westphal <fw@xxxxxxxxx> --- extensions/libxt_TPROXY.c | 59 ++++++++++++++++++++++++++++++++++ extensions/libxt_TPROXY.txlate | 17 ++++++++++ 2 files changed, 76 insertions(+) create mode 100644 extensions/libxt_TPROXY.txlate diff --git a/extensions/libxt_TPROXY.c b/extensions/libxt_TPROXY.c index d13ec85f92d0..4d2d7961ca2c 100644 --- a/extensions/libxt_TPROXY.c +++ b/extensions/libxt_TPROXY.c @@ -147,6 +147,62 @@ static void tproxy_tg1_parse(struct xt_option_call *cb) } } +static int tproxy_tg_xlate(struct xt_xlate *xl, + const struct xt_tproxy_target_info_v1 *info) +{ + int family = xt_xlate_get_family(xl); + uint32_t mask = info->mark_mask; + bool port_mandatory = false; + char buf[INET6_ADDRSTRLEN]; + + xt_xlate_add(xl, "tproxy to"); + + inet_ntop(family, &info->laddr, buf, sizeof(buf)); + + if (family == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(&info->laddr.in6)) + xt_xlate_add(xl, "[%s]", buf); + else if (family == AF_INET && info->laddr.ip) + xt_xlate_add(xl, "%s", buf); + else + port_mandatory = true; + + if (port_mandatory) + xt_xlate_add(xl, " :%d", ntohs(info->lport)); + else if (info->lport) + xt_xlate_add(xl, ":%d", ntohs(info->lport)); + + /* xt_TPROXY.c does: skb->mark = (skb->mark & ~mark_mask) ^ mark_value */ + if (mask == 0xffffffff) + xt_xlate_add(xl, "meta mark set 0x%x", info->mark_value); + else if (mask || info->mark_value) + xt_xlate_add(xl, "meta mark set meta mark & 0x%x or 0x%x", + ~mask, info->mark_value); + + return 1; +} + +static int tproxy_tg_xlate_v1(struct xt_xlate *xl, + const struct xt_xlate_tg_params *params) +{ + const struct xt_tproxy_target_info_v1 *data = (const void *)params->target->data; + + return tproxy_tg_xlate(xl, data); +} + +static int tproxy_tg_xlate_v0(struct xt_xlate *xl, + const struct xt_xlate_tg_params *params) +{ + const struct xt_tproxy_target_info *info = (const void *)params->target->data; + struct xt_tproxy_target_info_v1 t = { + .mark_mask = info->mark_mask, + .mark_value = info->mark_value, + .laddr.ip = info->laddr, + .lport = info->lport, + }; + + return tproxy_tg_xlate(xl, &t); +} + static struct xtables_target tproxy_tg_reg[] = { { .name = "TPROXY", @@ -160,6 +216,7 @@ static struct xtables_target tproxy_tg_reg[] = { .save = tproxy_tg_save, .x6_options = tproxy_tg0_opts, .x6_parse = tproxy_tg0_parse, + .xlate = tproxy_tg_xlate_v0, }, { .name = "TPROXY", @@ -173,6 +230,7 @@ static struct xtables_target tproxy_tg_reg[] = { .save = tproxy_tg_save4, .x6_options = tproxy_tg1_opts, .x6_parse = tproxy_tg1_parse, + .xlate = tproxy_tg_xlate_v1, }, { .name = "TPROXY", @@ -186,6 +244,7 @@ static struct xtables_target tproxy_tg_reg[] = { .save = tproxy_tg_save6, .x6_options = tproxy_tg1_opts, .x6_parse = tproxy_tg1_parse, + .xlate = tproxy_tg_xlate_v1, }, }; diff --git a/extensions/libxt_TPROXY.txlate b/extensions/libxt_TPROXY.txlate new file mode 100644 index 000000000000..0dfe3bbb430d --- /dev/null +++ b/extensions/libxt_TPROXY.txlate @@ -0,0 +1,17 @@ +iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 12345 --on-ip 10.0.0.1 --tproxy-mark 0x23/0xff +nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to 10.0.0.1:12345 meta mark set meta mark & 0xffffff00 or 0x23' + +iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-port 12345 --on-ip 10.0.0.1 --tproxy-mark 0x23 +nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345 meta mark set 0x23' + +iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-port 12345 --on-ip 10.0.0.1 +nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345' + +iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-ip 10.0.0.1 --on-port 0 +nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1' + +iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 12345 +nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :12345' + +iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 0 +nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :0' -- 2.43.0