From: Liping Zhang <[email protected]> For example: # iptables-translate -t mangle -A PREROUTING -m rpfilter nft add rule ip mangle PREROUTING fib saddr . iif oif != 0 counter
# iptables-translate -t mangle -A PREROUTING -m rpfilter --validmark \ --loose nft add rule ip mangle PREROUTING fib saddr . mark oif != 0 counter # ip6tables-translate -t mangle -A PREROUTING -m rpfilter --validmark \ --invert nft add rule ip6 mangle PREROUTING fib saddr . mark . iif oif 0 counter Finally, when the "--accept-local" option is specified, we can combine with "fib saddr type" to simulate it. But when it is used like this: "-m rpfilter --accept-local", it means "||" relationship, so we cannot translate it to one single nft rule, translation is not supported yet: # iptables-translate -t mangle -A PREROUTING -m rpfilter --accept-local nft # -t mangle -A PREROUTING -m rpfilter --accept-local When "--accpet-local" is combined with "--invert", it means "&&" relationship, so translation can be: # iptables-translate -t mangle -A PREROUTING -m rpfilter \ --accept-local --invert nft add rule ip mangle PREROUTING fib saddr type != local fib saddr \ . iif oif 0 counter Signed-off-by: Liping Zhang <[email protected]> --- extensions/libxt_rpfilter.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/extensions/libxt_rpfilter.c b/extensions/libxt_rpfilter.c index 168e703..d166baa 100644 --- a/extensions/libxt_rpfilter.c +++ b/extensions/libxt_rpfilter.c @@ -77,6 +77,31 @@ static void rpfilter_save(const void *ip, const struct xt_entry_match *match) return rpfilter_print_prefix(ip, match->data, "--"); } +static int rpfilter_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) +{ + const struct xt_rpfilter_info *info = (void *)params->match->data; + bool invert = info->flags & XT_RPFILTER_INVERT; + + if (info->flags & XT_RPFILTER_ACCEPT_LOCAL) { + if (invert) + xt_xlate_add(xl, "fib saddr type != local "); + else + return 0; + } + + xt_xlate_add(xl, "fib saddr "); + + if (info->flags & XT_RPFILTER_VALID_MARK) + xt_xlate_add(xl, ". mark "); + if (!(info->flags & XT_RPFILTER_LOOSE)) + xt_xlate_add(xl, ". iif "); + + xt_xlate_add(xl, "oif %s0", invert ? "" : "!= "); + + return 1; +} + static struct xtables_match rpfilter_match = { .family = NFPROTO_UNSPEC, .name = "rpfilter", @@ -88,6 +113,7 @@ static struct xtables_match rpfilter_match = { .save = rpfilter_save, .x6_parse = rpfilter_parse, .x6_options = rpfilter_opts, + .xlate = rpfilter_xlate, }; void _init(void) -- 2.5.5 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
