Skip to contentSkip to conversation

extensions: libipt_ttl: Add translation to nft

PATCH In review Shivani Bhardwaj 2 participants 2 messages Jan 4, 2016 – Jan 5, 2016 netfilter

lore
Share & tools
lore

Shivani Bhardwaj

author
#0 lore raw

PATCH v2 1/1 extensions: libipt_ttl: Add translation to nft

Add translation for module ttl to nftables.

Examples:

$ sudo iptables-translate -A INPUT -m ttl --ttl-eq 3 -j ACCEPT
nft add rule ip filter INPUT ip ttl 3 counter accept
$ sudo iptables-translate -A INPUT -m ttl --ttl-gt 5 -j ACCEPT
nft add rule ip filter INPUT ip ttl \> 5 counter accept
Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v2:
Remove the changes done in nft-ipv4

 extensions/libipt_ttl.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
extensions/libipt_ttl.c +30 -0
index 5fe08cc..5d897a7 100644
@@ -100,6 +100,35 @@ static void ttl_save(const void *ip, const struct xt_entry_match *match)
 	printf(" %u", info->ttl);
 }
 
+static int ttl_xlate(const struct xt_entry_match *match,
+		     struct xt_buf *buf, int numeric)
+{
+	const struct ipt_ttl_info *info =
+			(struct ipt_ttl_info *) match->data;
+
+		switch (info->mode) {
+		case IPT_TTL_EQ:
+			xt_buf_add(buf, "ip ttl");
+			break;
+		case IPT_TTL_NE:
+			xt_buf_add(buf, "ip ttl !=");
+			break;
+		case IPT_TTL_LT:
+			xt_buf_add(buf, "ip ttl \\<");
+			break;
+		case IPT_TTL_GT:
+			xt_buf_add(buf, "ip ttl \\>");
+			break;
+		default:
+			/* error */
+			break;
+	}
+
+	xt_buf_add(buf, " %u ", info->ttl);
+
+	return 1;
+}
+
 #define s struct ipt_ttl_info
 static const struct xt_option_entry ttl_opts[] = {
 	{.name = "ttl-lt", .id = O_TTL_LT, .excl = F_ANY, .type = XTTYPE_UINT8,

@@ -126,6 +155,7 @@ static struct xtables_match ttl_mt_reg = {
 	.x6_parse	= ttl_parse,
 	.x6_fcheck	= ttl_check,
 	.x6_options	= ttl_opts,
+	.xlate		= ttl_xlate,
 };
Signature · 1 line
1.9.1
maintainer
#1 lore raw
Quoted 9 lines · Shivani Bhardwaj

Add translation for module ttl to nftables.

Examples:

$ sudo iptables-translate -A INPUT -m ttl --ttl-eq 3 -j ACCEPT
nft add rule ip filter INPUT ip ttl 3 counter accept
$ sudo iptables-translate -A INPUT -m ttl --ttl-gt 5 -j ACCEPT
nft add rule ip filter INPUT ip ttl \> 5 counter accept

Applied with minor glitch.

Quoted 21 lines
Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v2:
Remove the changes done in nft-ipv4

 extensions/libipt_ttl.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
extensions/libipt_ttl.c +5 -0
index 5fe08cc..5d897a7 100644
@@ -100,6 +100,35 @@ static void ttl_save(const void *ip, const struct xt_entry_match *match)
 	printf(" %u", info->ttl);
 }
 
+static int ttl_xlate(const struct xt_entry_match *match,
+		     struct xt_buf *buf, int numeric)
+{
+	const struct ipt_ttl_info *info =
+			(struct ipt_ttl_info *) match->data;

extensions/libipt_ttl.c static void ttl_save(const void *ip, const struct xt_entry_match *match) · line 117

Quoted 10 lines
extensions/libipt_ttl.c +10 -0
+
+		switch (info->mode) {
+		case IPT_TTL_EQ:
+			xt_buf_add(buf, "ip ttl");
+			break;
+		case IPT_TTL_NE:
+			xt_buf_add(buf, "ip ttl !=");
+			break;
+		case IPT_TTL_LT:
+			xt_buf_add(buf, "ip ttl \\<");

I prefer you use 'lt' instead of \\<.

extensions/libipt_ttl.c static void ttl_save(const void *ip, const struct xt_entry_match *match) · line 120

Quoted 3 lines
extensions/libipt_ttl.c +3 -0
+			break;
+		case IPT_TTL_GT:
+			xt_buf_add(buf, "ip ttl \\>");

Same thing here: use 'gt'.

No need to resend, I have fixed this here.

Thanks.