Skip to content

GitLab

Commit 706c32c9 authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

Update upstream source from tag 'upstream/1.6.2' 

Update to upstream version '1.6.2'
with Debian dir 709e57568379856beca5301ab2678ceffca94a99
parents a82b926a 5beab31f
Expand all Hide whitespace changes
Inline Side-by-side
extensions/libxt_ecn.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A INPUT -m ecn --ecn-ip-ect 0
nft add rule ip filter INPUT ip ecn not-ect counter
iptables-translate -A INPUT -m ecn --ecn-ip-ect 1
nft add rule ip filter INPUT ip ecn ect1 counter
iptables-translate -A INPUT -m ecn --ecn-ip-ect 2
nft add rule ip filter INPUT ip ecn ect0 counter
iptables-translate -A INPUT -m ecn --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn ce counter
iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0
nft add rule ip filter INPUT ip ecn != not-ect counter
iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1
nft add rule ip filter INPUT ip ecn != ect1 counter
iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2
nft add rule ip filter INPUT ip ecn != ect0 counter
iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn != ce counter
extensions/libxt_esp.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A FORWARD -p esp -j ACCEPT
nft add rule ip filter FORWARD ip protocol esp counter accept
iptables-translate -A INPUT --in-interface wan --protocol esp -j ACCEPT
nft add rule ip filter INPUT iifname wan ip protocol esp counter accept
iptables-translate -A INPUT -p 50 -m esp --espspi 500 -j DROP
nft add rule ip filter INPUT esp spi 500 counter drop
iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP
nft add rule ip filter INPUT esp spi 500-600 counter drop
extensions/libxt_hashlimit.c
View file @ 706c32c9
This diff is collapsed.
extensions/libxt_hashlimit.man
View file @ 706c32c9
......@@ -51,6 +51,14 @@ After how many milliseconds do hash entries expire.
.TP
\fB\-\-hashlimit\-htable\-gcinterval\fP \fImsec\fP
How many milliseconds between garbage collection intervals.
.TP
\fB\-\-hashlimit\-rate\-match\fP
Classify the flow instead of rate-limiting it. This acts like a
true/flase match on whether the rate is above/below a certain number
.TP
\fB\-\-hashlimit\-rate\-interval\fP \fIsec\fP
Can be used with \-\-hashlimit\-rate\-match to specify the interval
at which the rate should be sampled
.PP
Examples:
.TP
......
extensions/libxt_hashlimit.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-above 20kb/s --hashlimit-burst 1mb --hashlimit-mode dstip --hashlimit-name https --hashlimit-dstmask 24 -m state --state NEW -j DROP
nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes} ct state new counter drop
iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-upto 300 --hashlimit-burst 15 --hashlimit-mode srcip,dstip --hashlimit-name https --hashlimit-htable-expire 300000 -m state --state NEW -j DROP
nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new counter drop
extensions/libxt_helper.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A FORWARD -m helper --helper sip
nft add rule ip filter FORWARD ct helper \"sip\" counter
iptables-translate -A FORWARD -m helper ! --helper ftp
nft add rule ip filter FORWARD ct helper != \"ftp\" counter
extensions/libxt_ipcomp.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -t filter -A INPUT -m ipcomp --ipcompspi 0x12 -j ACCEPT
nft add rule ip filter INPUT comp cpi 18 counter accept
iptables-translate -t filter -A INPUT -m ipcomp ! --ipcompspi 0x12 -j ACCEPT
nft add rule ip filter INPUT comp cpi != 18 counter accept
extensions/libxt_iprange.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A INPUT -m iprange --src-range 192.168.25.149-192.168.25.151 -j ACCEPT
nft add rule ip filter INPUT ip saddr 192.168.25.149-192.168.25.151 counter accept
iptables-translate -A INPUT -m iprange --dst-range 192.168.25.149-192.168.25.151 -j ACCEPT
nft add rule ip filter INPUT ip daddr 192.168.25.149-192.168.25.151 counter accept
iptables-translate -A INPUT -m iprange --dst-range 3.3.3.3-6.6.6.6 --src-range 4.4.4.4-7.7.7.7 -j ACCEPT
nft add rule ip filter INPUT ip saddr 4.4.4.4-7.7.7.7 ip daddr 3.3.3.3-6.6.6.6 counter accept
ip6tables-translate -A INPUT -m iprange ! --dst-range ::2d01-::2d03 -j ACCEPT
nft add rule ip6 filter INPUT ip6 daddr != ::2d01-::2d03 counter accept
ip6tables-translate -A INPUT -m iprange ! --dst-range ::2d01-::2d03 --src-range ::2d01-::2d03 -j ACCEPT
nft add rule ip6 filter INPUT ip6 saddr ::2d01-::2d03 ip6 daddr != ::2d01-::2d03 counter accept
extensions/libxt_length.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A INPUT -p icmp -m length --length 86:0xffff -j DROP
nft add rule ip filter INPUT ip protocol icmp meta length 86-65535 counter drop
iptables-translate -A INPUT -p udp -m length --length :400
nft add rule ip filter INPUT ip protocol udp meta length 0-400 counter
iptables-translate -A INPUT -p udp -m length --length 40
nft add rule ip filter INPUT ip protocol udp meta length 40 counter
iptables-translate -A INPUT -p udp -m length ! --length 40
nft add rule ip filter INPUT ip protocol udp meta length != 40 counter
extensions/libxt_limit.c
View file @ 706c32c9
......@@ -4,6 +4,7 @@
* Hervé Eychenne <rv@wallfire.org>
*/
#define _BSD_SOURCE 1
#define _DEFAULT_SOURCE 1
#define _ISOC99_SOURCE 1
#include <math.h>
#include <stdio.h>
......
extensions/libxt_limit.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A INPUT -m limit --limit 3/m --limit-burst 3
nft add rule ip filter INPUT limit rate 3/minute burst 3 packets counter
iptables-translate -A INPUT -m limit --limit 10/s --limit-burst 5
nft add rule ip filter INPUT limit rate 10/second burst 5 packets counter
iptables-translate -A INPUT -m limit --limit 10/s --limit-burst 0
nft add rule ip filter INPUT limit rate 10/second counter
extensions/libxt_mac.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A INPUT -m mac --mac-source 0a:12:3e:4f:b2:c6 -j DROP
nft add rule ip filter INPUT ether saddr 0a:12:3e:4f:b2:c6 counter drop
iptables-translate -A INPUT -p tcp --dport 80 -m mac --mac-source 0a:12:3e:4f:b2:c6 -j ACCEPT
nft add rule ip filter INPUT tcp dport 80 ether saddr 0a:12:3e:4f:b2:c6 counter accept
extensions/libxt_mark.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -I INPUT -p tcp -m mark ! --mark 0xa/0xa
nft insert rule ip filter INPUT ip protocol tcp mark and 0xa != 0xa counter
iptables-translate -I INPUT -p tcp -m mark ! --mark 0x1
nft insert rule ip filter INPUT ip protocol tcp mark != 0x1 counter
extensions/libxt_multiport.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept
iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport 80-88 counter accept
iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept
iptables-translate -t filter -A INPUT -p tcp -m multiport --sports 50 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp sport 50 counter accept
extensions/libxt_owner.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT
nft add rule ip nat OUTPUT tcp dport 80 skuid 0 counter accept
iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner --gid-owner 0-10 -j ACCEPT
nft add rule ip nat OUTPUT tcp dport 80 skgid 0-10 counter accept
iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner 1000 -j ACCEPT
nft add rule ip nat OUTPUT tcp dport 80 skuid != 1000 counter accept
extensions/libxt_pkttype.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A INPUT -m pkttype --pkt-type broadcast -j DROP
nft add rule ip filter INPUT pkttype broadcast counter drop
iptables-translate -A INPUT -m pkttype ! --pkt-type unicast -j DROP
nft add rule ip filter INPUT pkttype != unicast counter drop
iptables-translate -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
nft add rule ip filter INPUT pkttype multicast counter accept
extensions/libxt_policy.c
View file @ 706c32c9
......@@ -376,6 +376,31 @@ static void policy6_save(const void *ip, const struct xt_entry_match *match)
}
}
static int policy_xlate(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
static const unsigned int allowed = XT_POLICY_MATCH_STRICT |
XT_POLICY_MATCH_NONE |
XT_POLICY_MATCH_IN;
static const struct xt_policy_elem empty;
const struct xt_policy_info *info = (const void *)params->match->data;
if ((info->flags & ~allowed) || info->len > 1)
return 0;
if (memcmp(&info->pol[0], &empty, sizeof(empty)))
return 0;
xt_xlate_add(xl, "meta secpath ");
if (info->flags & XT_POLICY_MATCH_NONE)
xt_xlate_add(xl, "missing");
else
xt_xlate_add(xl, "exists");
return 1;
}
static struct xtables_match policy_mt_reg[] = {
{
.name = "policy",
......@@ -389,6 +414,7 @@ static struct xtables_match policy_mt_reg[] = {
.print = policy4_print,
.save = policy4_save,
.x6_options = policy_opts,
.xlate = policy_xlate,
},
{
.name = "policy",
......@@ -402,6 +428,7 @@ static struct xtables_match policy_mt_reg[] = {
.print = policy6_print,
.save = policy6_save,
.x6_options = policy_opts,
.xlate = policy_xlate,
},
};
......
extensions/libxt_policy.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A INPUT -m policy --pol ipsec --dir in
nft add rule ip filter INPUT meta secpath exists counter
iptables-translate -A INPUT -m policy --pol none --dir in
nft add rule ip filter INPUT meta secpath missing counter
extensions/libxt_quota.txlate 0 → 100644
View file @ 706c32c9
iptables-translate -A OUTPUT -m quota --quota 111
nft add rule ip filter OUTPUT quota 111 bytes counter
iptables-translate -A OUTPUT -m quota ! --quota 111
nft add rule ip filter OUTPUT quota over 111 bytes counter
extensions/libxt_recent.c
View file @ 706c32c9
......@@ -199,7 +199,7 @@ static void recent_print(const void *ip, const struct xt_entry_match *match,
if(info->hit_count) printf(" hit_count: %d", info->hit_count);
if (info->check_set & XT_RECENT_TTL)
printf(" TTL-Match");
if(info->name) printf(" name: %s", info->name);
printf(" name: %s", info->name);
if (info->side == XT_RECENT_SOURCE)
printf(" side: source");
if (info->side == XT_RECENT_DEST)
......@@ -239,7 +239,7 @@ static void recent_save(const void *ip, const struct xt_entry_match *match,
if(info->hit_count) printf(" --hitcount %d", info->hit_count);
if (info->check_set & XT_RECENT_TTL)
printf(" --rttl");
if(info->name) printf(" --name %s",info->name);
printf(" --name %s",info->name);
switch(family) {
case NFPROTO_IPV4:
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment