| Message ID | 20160104180002.GA10529@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Mon, Jan 04, 2016 at 11:30:02PM +0530, Shivani Bhardwaj wrote: > Add translation for module ttl to nftables. > > Examples: > > $ sudo iptables-translate -A INPUT -m ttl --ttl-eq 3 -j ACCEPT > nft add rule ip filter INPUT ip ttl 3 counter accept > > $ sudo iptables-translate -A INPUT -m ttl --ttl-gt 5 -j ACCEPT > nft add rule ip filter INPUT ip ttl \> 5 counter accept Applied with minor glitch. > Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> > --- > Changes in v2: > Remove the changes done in nft-ipv4 > > extensions/libipt_ttl.c | 30 ++++++++++++++++++++++++++++++ > 1 file changed, 30 insertions(+) > > diff --git a/extensions/libipt_ttl.c b/extensions/libipt_ttl.c > index 5fe08cc..5d897a7 100644 > --- a/extensions/libipt_ttl.c > +++ b/extensions/libipt_ttl.c > @@ -100,6 +100,35 @@ static void ttl_save(const void *ip, const struct xt_entry_match *match) > printf(" %u", info->ttl); > } > > +static int ttl_xlate(const struct xt_entry_match *match, > + struct xt_buf *buf, int numeric) > +{ > + const struct ipt_ttl_info *info = > + (struct ipt_ttl_info *) match->data; > + > + switch (info->mode) { > + case IPT_TTL_EQ: > + xt_buf_add(buf, "ip ttl"); > + break; > + case IPT_TTL_NE: > + xt_buf_add(buf, "ip ttl !="); > + break; > + case IPT_TTL_LT: > + xt_buf_add(buf, "ip ttl \\<"); I prefer you use 'lt' instead of \\<. > + break; > + case IPT_TTL_GT: > + xt_buf_add(buf, "ip ttl \\>"); Same thing here: use 'gt'. No need to resend, I have fixed this here. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libipt_ttl.c b/extensions/libipt_ttl.c index 5fe08cc..5d897a7 100644 --- a/extensions/libipt_ttl.c +++ b/extensions/libipt_ttl.c @@ -100,6 +100,35 @@ static void ttl_save(const void *ip, const struct xt_entry_match *match) printf(" %u", info->ttl); } +static int ttl_xlate(const struct xt_entry_match *match, + struct xt_buf *buf, int numeric) +{ + const struct ipt_ttl_info *info = + (struct ipt_ttl_info *) match->data; + + switch (info->mode) { + case IPT_TTL_EQ: + xt_buf_add(buf, "ip ttl"); + break; + case IPT_TTL_NE: + xt_buf_add(buf, "ip ttl !="); + break; + case IPT_TTL_LT: + xt_buf_add(buf, "ip ttl \\<"); + break; + case IPT_TTL_GT: + xt_buf_add(buf, "ip ttl \\>"); + break; + default: + /* error */ + break; + } + + xt_buf_add(buf, " %u ", info->ttl); + + return 1; +} + #define s struct ipt_ttl_info static const struct xt_option_entry ttl_opts[] = { {.name = "ttl-lt", .id = O_TTL_LT, .excl = F_ANY, .type = XTTYPE_UINT8, @@ -126,6 +155,7 @@ static struct xtables_match ttl_mt_reg = { .x6_parse = ttl_parse, .x6_fcheck = ttl_check, .x6_options = ttl_opts, + .xlate = ttl_xlate, };
Add translation for module ttl to nftables. Examples: $ sudo iptables-translate -A INPUT -m ttl --ttl-eq 3 -j ACCEPT nft add rule ip filter INPUT ip ttl 3 counter accept $ sudo iptables-translate -A INPUT -m ttl --ttl-gt 5 -j ACCEPT nft add rule ip filter INPUT ip ttl \> 5 counter accept Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> --- Changes in v2: Remove the changes done in nft-ipv4 extensions/libipt_ttl.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)