From patchwork Mon Mar 7 21:22:55 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: nevola X-Patchwork-Id: 593222 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id C5FB0140322 for ; Tue, 8 Mar 2016 08:23:00 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=l8fVvbay; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753390AbcCGVW7 (ORCPT ); Mon, 7 Mar 2016 16:22:59 -0500 Received: from mail-wm0-f43.google.com ([74.125.82.43]:38118 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752891AbcCGVW7 (ORCPT ); Mon, 7 Mar 2016 16:22:59 -0500 Received: by mail-wm0-f43.google.com with SMTP id l68so2750893wml.1 for ; Mon, 07 Mar 2016 13:22:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=gnnnwGSJsb03QcQHWrWgoKsHGoyxOmhhzubSOi94DLc=; b=l8fVvbayNLXIUSh06t44/g+pI5EzUxXSpNUZeRK4+b7g9YPj8OxqNrxMtJp7P1a60n LjVs5YPnNeUIo2XO2wNYkRSShfWR8XwrMjeI2mzLsauWE5qMTGGxDniPOkl7H6Xm6Go1 YdeFMCMlWOMlpBmkSGYTYOffk6pMn094m+0R38Vfdbuy1clbtWD6RAQZjBUdw0S5x7LD nlAwpsN7OQXzO1nucXlbgZESJJgSRdbbnbwWAXZmchgM+405XXDkCX8QiSM2+RsBZNGE G32wtMWO1WDj3dlmc0TvudQe6pvTc+ja5predNSFjrbhPWIT858gXgNBOsv/xB/lPYkV 1Vng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=gnnnwGSJsb03QcQHWrWgoKsHGoyxOmhhzubSOi94DLc=; b=GLn1RgqP4yd1yCQa0FIElASLyAT3pRXNaOuHnjM976W/PoeE1DM0njP9AjBT7qK2nl fHBWSj0XCDqfEw7N5kin7YMC/hwrSz2jDGlJt8nd3R2oGGfDABr+QvPL5HekEN7NHkvS u+1cYz0pOLYZmZ5Sc83iGIfk2N4tC4SymUfaCC/O5oFzTHOfE99XYYGTW5odqcImqZEq BFRSB8CbCgSPKbYFkH8/WD/d5LSbIofFU06wBtZD8kR7UCQCCW2ZPHOl4EexNccqOHLD Zgd38YzKqj9t+/j+ux5BGvtATgKuexIoq8kWJKHrNeeDFQj8UpOEWXtUqfq2hBI5437m Q5SA== X-Gm-Message-State: AD7BkJLsgloXRW5+/W5G6wF02cveYzR1QPgNhtBxH5ME1E1hHl53JmrrmwfnSmhUh8fWww== X-Received: by 10.194.123.131 with SMTP id ma3mr24800186wjb.107.1457385777686; Mon, 07 Mar 2016 13:22:57 -0800 (PST) Received: from sonyv (151.Red-79-150-198.dynamicIP.rima-tde.net. [79.150.198.151]) by smtp.gmail.com with ESMTPSA id h128sm65949wmf.23.2016.03.07.13.22.56 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Mon, 07 Mar 2016 13:22:57 -0800 (PST) Date: Mon, 7 Mar 2016 22:22:55 +0100 From: Laura Garcia Liebana To: netfilter-devel@vger.kernel.org Cc: shivanib134@gmail.com, pablo@netfilter.org, outreachy-kernel@googlegroups.com Subject: [PATCHv3] extensions: libip6t_icmp6: Add translation to nft Message-ID: <20160307212252.GA10639@sonyv> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Add translation for icmpv6 to nftables. Not supported types in nftables are: no-route, communication-prohibited, beyond-scope, address-unreachable, port-unreachable, failed-policy, reject-route, ttl-zero-during-transit, ttl-zero-during-reassembly, bad-header, unknown-header-type and unknown-option. Examples: $ ip6tables-translate -t filter -A INPUT -m icmp6 --icmpv6-type 1 -j LOG nft add rule ip6 filter INPUT icmpv6 type destination-unreachable counter log level warn $ ip6tables-translate -t filter -A INPUT -m icmp6 --icmpv6-type neighbour-advertisement -j LOG nft add rule ip6 filter INPUT icmpv6 type nd-neighbor-advert counter log level warn $ ip6tables-translate -t filter -A INPUT -m icmp6 ! --icmpv6-type packet-too-big -j LOG nft add rule ip6 filter INPUT icmpv6 type != packet-too-big counter log level warn Signed-off-by: Laura Garcia Liebana --- v2: - Detection of not supported types in nftables, as Shivani suggested. v3: - Generalize the source code, as Pablo suggested. extensions/libip6t_icmp6.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c index e183ce6..08eca99 100644 --- a/extensions/libip6t_icmp6.c +++ b/extensions/libip6t_icmp6.c @@ -4,6 +4,9 @@ #include #include /* INT_MAX in ip6_tables.h */ #include +#include + +#define XT_ICMPV6_TYPE(type) (type - ND_ROUTER_SOLICIT) enum { O_ICMPV6_TYPE = 0, @@ -15,6 +18,14 @@ struct icmpv6_names { uint8_t code_min, code_max; }; +static const char *icmp6_type_xlate_array[] = { + [XT_ICMPV6_TYPE(ND_ROUTER_SOLICIT)] = "nd-router-solicit", + [XT_ICMPV6_TYPE(ND_ROUTER_ADVERT)] = "nd-router-advert", + [XT_ICMPV6_TYPE(ND_NEIGHBOR_SOLICIT)] = "nd-neighbor-solicit", + [XT_ICMPV6_TYPE(ND_NEIGHBOR_ADVERT)] = "nd-neighbor-advert", + [XT_ICMPV6_TYPE(ND_REDIRECT)] = "nd-redirect", +}; + static const struct icmpv6_names icmpv6_codes[] = { { "destination-unreachable", 1, 0, 0xFF }, { "no-route", 1, 0, 0 }, @@ -222,6 +233,59 @@ static void icmp6_save(const void *ip, const struct xt_entry_match *match) printf("/%u", icmpv6->code[0]); } +static const char *icmp6_type_xlate(unsigned int type) +{ + if (type < ND_ROUTER_SOLICIT || type > ND_REDIRECT) + return NULL; + + return icmp6_type_xlate_array[XT_ICMPV6_TYPE(type)]; +} + +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, + unsigned int code_min, unsigned int code_max) +{ + unsigned int i; + const char *type_name; + + if (code_min == code_max) + return 0; + + type_name = icmp6_type_xlate(icmptype); + + if (type_name) { + xt_xlate_add(xl, type_name); + } else { + for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) + if (icmpv6_codes[i].type == icmptype && + icmpv6_codes[i].code_min == code_min && + icmpv6_codes[i].code_max == code_max) + break; + + if (i != ARRAY_SIZE(icmpv6_codes)) + xt_xlate_add(xl, icmpv6_codes[i].name); + else + return 0; + } + + return 1; +} + +static int icmp6_xlate(const struct xt_entry_match *match, struct xt_xlate *xl, + int numeric) +{ + const struct ip6t_icmp *info = (struct ip6t_icmp *)match->data; + + xt_xlate_add(xl, "icmpv6 type%s ", + (info->invflags & IP6T_ICMP_INV) ? " !=" : ""); + + if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) + return 0; + + xt_xlate_add(xl, " "); + + return 1; +} + static struct xtables_match icmp6_mt6_reg = { .name = "icmp6", .version = XTABLES_VERSION, @@ -234,6 +298,7 @@ static struct xtables_match icmp6_mt6_reg = { .save = icmp6_save, .x6_parse = icmp6_parse, .x6_options = icmp6_opts, + .xlate = icmp6_xlate, }; void _init(void)