extensions: libip6t_hbh: Add translation to nft
diff mbox

Message ID 20160601220804.GA3515@sonyv
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Laura Garcia Liebana June 1, 2016, 10:08 p.m. UTC
Add translation for Hop-By-Hop header to nftables. Hbh options are not
supported yet in nft.

$ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength 22 counter

$ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength != 22 counter

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
---
 extensions/libip6t_hbh.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

Comments

Pablo Neira Ayuso June 2, 2016, 11:08 a.m. UTC | #1
On Thu, Jun 02, 2016 at 12:08:08AM +0200, Laura Garcia Liebana wrote:
> Add translation for Hop-By-Hop header to nftables. Hbh options are not
> supported yet in nft.

It would be good to document this in the wiki, as Shivani did already.
It would be also good if you can document what is missing to be
capable of matching these hbh options there.

> $ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22
> nft add rule ip6 filter INPUT hbh hdrlength 22 counter
> 
> $ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22
> nft add rule ip6 filter INPUT hbh hdrlength != 22 counter

Applied, thanks Laura.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Laura Garcia Liebana June 2, 2016, 3:31 p.m. UTC | #2
On Thu, Jun 02, 2016 at 01:08:47PM +0200, Pablo Neira Ayuso wrote:
> On Thu, Jun 02, 2016 at 12:08:08AM +0200, Laura Garcia Liebana wrote:
> > Add translation for Hop-By-Hop header to nftables. Hbh options are not
> > supported yet in nft.
> 
> It would be good to document this in the wiki, as Shivani did already.
> It would be also good if you can document what is missing to be
> capable of matching these hbh options there.
>

It seems that is already documented in the official wiki.

 ip6

     hbh 

     [Waiting for support of options] (partial translations available) 

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c
index c0389ed..416681d 100644
--- a/extensions/libip6t_hbh.c
+++ b/extensions/libip6t_hbh.c
@@ -164,6 +164,22 @@  static void hbh_save(const void *ip, const struct xt_entry_match *match)
 	print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
 }
 
+static int hbh_xlate(const void *ip, const struct xt_entry_match *match,
+		     struct xt_xlate *xl, int numeric)
+{
+	const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
+
+	if (!(optinfo->flags & IP6T_OPTS_LEN) ||
+	    (optinfo->flags & IP6T_OPTS_OPTS))
+		return 0;
+
+	xt_xlate_add(xl, "hbh hdrlength %s%u ",
+		     (optinfo->invflags & IP6T_OPTS_INV_LEN) ? "!= " : "",
+		     optinfo->hdrlen);
+
+	return 1;
+}
+
 static struct xtables_match hbh_mt6_reg = {
 	.name 		= "hbh",
 	.version	= XTABLES_VERSION,
@@ -175,6 +191,7 @@  static struct xtables_match hbh_mt6_reg = {
 	.save		= hbh_save,
 	.x6_parse	= hbh_parse,
 	.x6_options	= hbh_opts,
+	.xlate		= hbh_xlate,
 };
 
 void