You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by "wengzhe (via GitHub)" <gi...@apache.org> on 2024/06/17 03:26:54 UTC
[PR] system/iptables: Support ip6tables & filter table [nuttx-apps]
wengzhe opened a new pull request, #2415:
URL: https://github.com/apache/nuttx-apps/pull/2415
## Summary
Patches included:
- netlib/iptables: Change matching to memcmp all related structs
- netlib/iptables: Add functions for filter table
- system/iptables: Support filter table
- netlib/ip6tables: Add functions for ip6tables & filter table
- system/iptables: Support ip6tables & filter table
- system/iptables: Rename TABLE_NAME_NAT to XT_TABLE_NAME_NAT
Add supports for filter table, usage is same as Linux's iptables, including:
- [!] -p/--protocol
- [!] -s/--source -d/--destination
- [!] -i/--in-interface -o/--out-interface
- [!] --sport/--source-port --dport/--destination-port
- [!] --icmp-type
Examples:
```
> iptables -P FORWARD DROP
> iptables -I INPUT -i eth0 ! -p icmp -j DROP
> iptables -t filter -A FORWARD -p tcp -s 10.0.1.2/24 -d 10.0.3.4/24 -i eth0 -o eth1 --sport 3000:3200 --dport 123:65535 -j ACCEPT
> iptables -t filter -I FORWARD 2 -p icmp ! -s 123.123.123.123 ! -i eth0 -o eth1 ! --icmp-type 255 -j REJECT
> iptables -L
Chain INPUT (policy ACCEPT)
target prot idev odev source destination
DROP !icmp eth0 any anywhere anywhere
Chain FORWARD (policy DROP)
target prot idev odev source destination
ACCEPT tcp eth0 eth1 10.0.1.2/24 10.0.3.4/24 tcp spts:3000:3200 dpts:123:65535
REJECT icmp !eth0 eth1 !123.123.123.123/32 anywhere icmp !type 255
Chain OUTPUT (policy ACCEPT)
target prot idev odev source destination
```
Note:
- We're dropping dependency of argtable3, since it is difficult to support command like '! -p tcp ! -i eth0'
## Impact
`netlib/ip[6]tables` and `system/iptables` only.
## Testing
Together with https://github.com/apache/nuttx/pull/12508
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] system/iptables: Support ip6tables & filter table [nuttx-apps]
Posted by "wengzhe (via GitHub)" <gi...@apache.org>.
wengzhe commented on PR #2415:
URL: https://github.com/apache/nuttx-apps/pull/2415#issuecomment-2172361647
Oops, CI failed because of a lack of definitions added in https://github.com/apache/nuttx/pull/12508 and I don't know how to let them CI together. Or maybe we can retrigger this PR's CI after the kernel's one has been merged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org