| Message ID | 20160307212141.GA10594@sonyv |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
On Mon, Mar 07, 2016 at 10:21:44PM +0100, Laura Garcia Liebana wrote: > Add translation for icmp to nftables. Not supported types in nftables These are actually icmp codes that we don't support yet, right? > are: any, network-unreachable, host-unreachable, protocol-unreachable, > port-unreachable, fragmentation-needed, source-route-failed, > network-unknown, host-unknown, network-prohibited, host-prohibited, > TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, > host-precedence-violation, precedence-cutoff, network-redirect, > host-redirect, TOS-network-redirect, TOS-host-redirect, > router-advertisement, router-solicitation, ttl-zero-during-transit, > ttl-zero-during-reassembly, ip-header-bad and required-option-missing. > > Examples: > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG > nft add rule ip filter INPUT icmp type echo-reply counter log level warn > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG > nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn > > $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG > nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn > > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> > --- > v2: > - Detection of not supported types in nftables, as Shivani suggested. > v3: > - Fix array iteration protection. > > extensions/libipt_icmp.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 48 insertions(+), 1 deletion(-) > > diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c > index 666e7da..2c8be87 100644 > --- a/extensions/libipt_icmp.c > +++ b/extensions/libipt_icmp.c > @@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type, > } > > static void icmp_print(const void *ip, const struct xt_entry_match *match, > - int numeric) > + int numeric) I think this change doesn't below this patch. > { > const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; > > @@ -249,6 +249,52 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) > } > } > > +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, > + unsigned int code_min, unsigned int code_max) ^^^^^^ This should be aligned with the line above: static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, unsigned int code_min, unsigned int code_max) > +{ > + unsigned int i; > + > + if (code_min == code_max) > + return 0; > + > + switch (icmptype) { > + case 0xFF: You can skip the 0xff case by adding nothing. > + case 9: > + case 10: You can send me a two-liner for this for nft, so we don't need this I think. > + return 0; > + default: > + for (i = 0; i < ARRAY_SIZE(icmp_codes); ++i) > + if (icmp_codes[i].type == icmptype && > + icmp_codes[i].code_min == code_min && > + icmp_codes[i].code_max == code_max) > + break; > + > + if (i != ARRAY_SIZE(icmp_codes)) > + xt_xlate_add(xl, icmp_codes[i].name); > + else > + return 0; > + } > + > + return 1; > +} -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Hello Pablo,
I would require some guidance regarding the libxt_multiport translation in nft.
If the translation is over ip4 family :
$ iptables-translate -A INPUT -p tcp -m multiport --ports 3:4 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp dport { 3-4 } tcp sport { 3-4 } counter accept
^^^^^^^^^^^
this causes problem.
Similarly for ipv6 :
$ ip6tables-translate -A input -p tcp -m multiport --dports 1024:2048,2049:3333 -j ACCEPT
nft add rule ip6 filter input meta l4proto tcp dport { 1024-2048,2049-3333 } counter accept
^^^^^^^^^^^^
this is causing problem.
both the strings "ip protocol" and "meta l4proto" is not introduced by libxt_multiport.
And in the absence of both , the command works.
For example ,
$ nft add rule ip filter INPUT tcp dport { 3-4 } tcp sport { 3-4 } counter accept
$ nft add rule ip6 filter input tcp dport { 1024-2048,2049-3333 } counter accept
Any comment regarding this behaviour ?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
On 9 March 2016 at 08:05, FaTe <gokuvsvegita@gmail.com> wrote: > Hello Pablo, > > I would require some guidance regarding the libxt_multiport translation in nft. > > If the translation is over ip4 family : > $ iptables-translate -A INPUT -p tcp -m multiport --ports 3:4 -j ACCEPT > nft add rule ip filter INPUT ip protocol tcp dport { 3-4 } tcp sport { 3-4 } counter accept > ^^^^^^^^^^^ > this causes problem. > Similarly for ipv6 : > $ ip6tables-translate -A input -p tcp -m multiport --dports 1024:2048,2049:3333 -j ACCEPT > nft add rule ip6 filter input meta l4proto tcp dport { 1024-2048,2049-3333 } counter accept > ^^^^^^^^^^^^ > this is causing problem. > > both the strings "ip protocol" and "meta l4proto" is not introduced by libxt_multiport. > And in the absence of both , the command works. > > For example , > $ nft add rule ip filter INPUT tcp dport { 3-4 } tcp sport { 3-4 } counter accept > > $ nft add rule ip6 filter input tcp dport { 1024-2048,2049-3333 } counter accept > > Any comment regarding this behaviour ? They are different statements, rules should be something like: * meta l4proto tcp tcp dport XX * ip protocol tcp tcp dport XX However, the two statements are redundants... the second implies the first.
On Wednesday 09 March 2016 03:36 PM, Arturo Borrero Gonzalez wrote: > On 9 March 2016 at 08:05, FaTe <gokuvsvegita@gmail.com> wrote: >> Hello Pablo, >> >> I would require some guidance regarding the libxt_multiport translation in nft. >> >> If the translation is over ip4 family : >> $ iptables-translate -A INPUT -p tcp -m multiport --ports 3:4 -j ACCEPT >> nft add rule ip filter INPUT ip protocol tcp dport { 3-4 } tcp sport { 3-4 } counter accept >> ^^^^^^^^^^^ >> this causes problem. >> Similarly for ipv6 : >> $ ip6tables-translate -A input -p tcp -m multiport --dports 1024:2048,2049:3333 -j ACCEPT >> nft add rule ip6 filter input meta l4proto tcp dport { 1024-2048,2049-3333 } counter accept >> ^^^^^^^^^^^^ >> this is causing problem. >> >> both the strings "ip protocol" and "meta l4proto" is not introduced by libxt_multiport. >> And in the absence of both , the command works. >> >> For example , >> $ nft add rule ip filter INPUT tcp dport { 3-4 } tcp sport { 3-4 } counter accept >> >> $ nft add rule ip6 filter input tcp dport { 1024-2048,2049-3333 } counter accept >> >> Any comment regarding this behaviour ? > > They are different statements, rules should be something like: > * meta l4proto tcp tcp dport XX > * ip protocol tcp tcp dport XX > > However, the two statements are redundants... the second implies the first. Thanks Arturo ! It works. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c index 666e7da..2c8be87 100644 --- a/extensions/libipt_icmp.c +++ b/extensions/libipt_icmp.c @@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type, } static void icmp_print(const void *ip, const struct xt_entry_match *match, - int numeric) + int numeric) { const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; @@ -249,6 +249,52 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) } } +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, + unsigned int code_min, unsigned int code_max) +{ + unsigned int i; + + if (code_min == code_max) + return 0; + + switch (icmptype) { + case 0xFF: + case 9: + case 10: + return 0; + default: + for (i = 0; i < ARRAY_SIZE(icmp_codes); ++i) + if (icmp_codes[i].type == icmptype && + icmp_codes[i].code_min == code_min && + icmp_codes[i].code_max == code_max) + break; + + if (i != ARRAY_SIZE(icmp_codes)) + xt_xlate_add(xl, icmp_codes[i].name); + else + return 0; + } + + return 1; +} + +static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl, + int numeric) +{ + const struct ipt_icmp *info = (struct ipt_icmp *)match->data; + + xt_xlate_add(xl, "icmp type%s ", + (info->invflags & IPT_ICMP_INV) ? " !=" : ""); + + if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) + return 0; + + xt_xlate_add(xl, " "); + + return 1; +} + + static struct xtables_match icmp_mt_reg = { .name = "icmp", .version = XTABLES_VERSION, @@ -261,6 +307,7 @@ static struct xtables_match icmp_mt_reg = { .save = icmp_save, .x6_parse = icmp_parse, .x6_options = icmp_opts, + .xlate = icmp_xlate, }; void _init(void)
Add translation for icmp to nftables. Not supported types in nftables are: any, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, router-advertisement, router-solicitation, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing. Examples: $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG nft add rule ip filter INPUT icmp type echo-reply counter log level warn $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> --- v2: - Detection of not supported types in nftables, as Shivani suggested. v3: - Fix array iteration protection. extensions/libipt_icmp.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 48 insertions(+), 1 deletion(-)