extensions: libxt_pkttype: Add translation to nft
PATCH 1/1 extensions: libxt_pkttype: Add translation to nft
Add translation for packet type to nftables.
Examples:
$ sudo iptables-translate -A INPUT -m pkttype --pkt-type broadcast -j DROP nft add rule ip filter INPUT pkttype broadcast counter drop
$ sudo iptables-translate -A INPUT -m pkttype ! --pkt-type unicast -j DROP nft add rule ip filter INPUT pkttype != unicast counter drop
Signed-off-by Shivani Bhardwaj <[email protected]>
--- extensions/libxt_pkttype.c | 36 ++++++++++++++++++++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-)
extensions/libxt_pkttype.c +34 -2
@@ -102,7 +102,7 @@ static void pkttype_print(const void *ip, const struct xt_entry_match *match, int numeric) {const struct xt_pkttype_info *info = (const void *)match->data; - +printf (" PKTTYPE %s= " , info->invert ?"!" :"" );print_pkttype (info); }
@@ -110,11 +110,42 @@ static void pkttype_print(const void *ip, const struct xt_entry_match *match,static void pkttype_save (const void *ip,const struct xt_entry_match *match) {const struct xt_pkttype_info *info = (const void *)match->data; - +printf ("%s --pkt-type " , info->invert ?" !" :"" );print_pkttype (info); } +static const struct pkttypes supported_types_xlate[] = { + {"unicast" ,PACKET_HOST ,1 ,"to us" }, + {"broadcast" ,PACKET_BROADCAST ,1 ,"to all" }, + {"multicast" ,PACKET_MULTICAST ,1 ,"to group" }, + }; + +static void print_pkttype_xlate (const struct xt_pkttype_info *info, +struct xt_buf *buf) +{ +unsigned int i; + +for (i =0 ; i <ARRAY_SIZE (supported_types); ++i) +if (supported_types_xlate[i].pkttype == info->pkttype) { +xt_buf_add (buf,"%s " , supported_types_xlate[i].name); +return ; + } + +xt_buf_add (buf,"%d" , info->pkttype); +} + +static int pkttype_xlate (const struct xt_entry_match *match, +struct xt_buf *buf,int numeric) +{ +const struct xt_pkttype_info *info = (const void *)match->data; + +xt_buf_add (buf,"pkttype%s " , info->invert ?" !=" :"" ); +print_pkttype_xlate (info, buf); + +return 1 ; +} +static struct xtables_match pkttype_match = { .family =NFPROTO_UNSPEC , .name ="pkttype" ,
@@ -126,6 +157,7 @@ static struct xtables_match pkttype_match = { .save = pkttype_save, .x6_parse = pkttype_parse, .x6_options = pkttype_opts, + .xlate = pkttype_xlate, };void _init (void )
Signature · 1 line
1.9.1
Pablo Neira Ayuso
maintainerextensions/libxt_pkttype.c static void pkttype_print(const void *ip, const struct xt_entry_match *match, · line 121
Quoted 4 lines · Shivani Bhardwaj
extensions/libxt_pkttype.c +4
-0+static const struct pkttypes supported_types_xlate[] = { + {"unicast" ,PACKET_HOST ,1 ,"to us" }, + {"broadcast" ,PACKET_BROADCAST ,1 ,"to all" }, + {"multicast" ,PACKET_MULTICAST ,1 ,"to group" },
^^^^^^^^^^^^^
Do we need these fields?
Quoted 8 lines · Pablo Neira Ayuso
extensions/libxt_pkttype.c static void pkttype_print(const void *ip, const struct xt_entry_match *match, · line 121
Quoted 4 lines · Shivani Bhardwaj
extensions/libxt_pkttype.c +4
-0+static const struct pkttypes supported_types_xlate[] = { + {"unicast" ,PACKET_HOST ,1 ,"to us" }, + {"broadcast" ,PACKET_BROADCAST ,1 ,"to all" }, + {"multicast" ,PACKET_MULTICAST ,1 ,"to group" },^^^^^^^^^^^^^Do we need these fields?
Not really. Sending v2.