extensions: libipt_ah: Add translation to nft
PATCH 1/1 extensions: libipt_ah: Add translation to nft
Add translation for Authentication Header to nftables.
Examples:
$ sudo iptables-translate -A INPUT -p 51 -m ah --ahspi 500 -j DROP nft add rule ip filter INPUT ah spi 500 counter drop
$ sudo iptables-translate -A INPUT -p 51 -m ah --ahspi 500:600 -j DROP nft add rule ip filter INPUT ah spi 500-600 counter drop
$ sudo iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP nft add rule ip filter INPUT ah spi != 50 counter drop
Signed-off-by Shivani Bhardwaj <[email protected]>
--- extensions/libipt_ah.c | 37 ++++++++++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 9 deletions(-)
extensions/libipt_ah.c +28 -9
@@ -52,15 +52,15 @@ print_spis(const char *name, uint32_t min, uint32_t max,printf ("%u" , min); }else {printf ("s:%s" , inv); -printf ("%u" ,min); +printf ("%u" , min);printf (":" ); -printf ("%u" ,max); +printf ("%u" , max); } } }static void ah_print (const void *ip,const struct xt_entry_match *match, -int numeric) +int numeric) {const struct ipt_ah *ah = (struct ipt_ah *)match->data;
@@ -92,18 +92,37 @@ static void ah_save(const void *ip, const struct xt_entry_match *match) } +static int ah_xlate (const struct xt_entry_match *match, +struct xt_buf *buf,int numeric) +{ +const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; + +if (!(ahinfo->spis[0 ] ==0 && ahinfo->spis[1 ] ==0xFFFFFFFF )) { +xt_buf_add (buf,"ah spi%s " , + (ahinfo->invflags &IPT_AH_INV_SPI ) ?" !=" :"" ); +if (ahinfo->spis[0 ] != ahinfo->spis[1 ]) +xt_buf_add (buf,"%u-%u " , ahinfo->spis[0 ], + ahinfo->spis[1 ]); +else +xt_buf_add (buf,"%u " , ahinfo->spis[0 ]); + } + +return 1 ; +} +static struct xtables_match ah_mt_reg = { - .name ="ah" , - .version =XTABLES_VERSION , + .name ="ah" , + .version =XTABLES_VERSION , .family =NFPROTO_IPV4 , .size =XT_ALIGN (sizeof (struct ipt_ah )), - .userspacesize =XT_ALIGN (sizeof (struct ipt_ah )), - .help = ah_help, + .userspacesize =XT_ALIGN (sizeof (struct ipt_ah )), + .help = ah_help, .init = ah_init, - .print = ah_print, - .save = ah_save, + .print = ah_print, + .save = ah_save, .x6_parse = ah_parse, .x6_options = ah_opts, + .xlate = ah_xlate, };void
Signature · 1 line
1.9.1
Quoted 4 lines · Shivani Bhardwaj
Add translation for Authentication Header to nftables.
Examples:
Quoted 8 lines
$ sudo iptables-translate -A INPUT -p 51 -m ah --ahspi 500 -j DROP nft add rule ip filter INPUT ah spi 500 counter drop$ sudo iptables-translate -A INPUT -p 51 -m ah --ahspi 500:600 -j DROP nft add rule ip filter INPUT ah spi 500-600 counter drop$ sudo iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP nft add rule ip filter INPUT ah spi != 50 counter drop
Applied, thanks.