extensions: libip6t_icmp6: Add translation to nft
PATCH 1/1 extensions: libip6t_icmp6: Add translation to nft
Add translation for icmpv6 to nftables.
Examples:
$ ip6tables-translate -t filter -A INPUT -m icmp6 --icmpv6-type 1 -j LOG nft add rule ip6 filter INPUT icmpv6 type destination-unreachable counter log level warn
$ ip6tables-translate -t filter -A INPUT -m icmp6 --icmpv6-type 1/3 -j LOG nft add rule ip6 filter INPUT icmpv6 type address-unreachable counter log level warn
$ ip6tables-translate -t filter -A INPUT -m icmp6 ! --icmpv6-type 2 -j LOG nft add rule ip6 filter INPUT icmpv6 type != packet-too-big counter log level warn
Signed-off-by Laura Garcia Liebana <[email protected]>
--- extensions/libip6t_icmp6.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
extensions/libip6t_icmp6.c +30 -0
@@ -222,6 +222,35 @@ static void icmp6_save(const void *ip, const struct xt_entry_match *match)printf ("/%u" , icmpv6->code[0 ]); } +static void type_xlate_print (struct xt_xlate *xl,unsigned int icmptype, +unsigned int code_min,unsigned int code_max) +{ +unsigned int i; + +for (i =0 ;ARRAY_SIZE (icmpv6_codes); i++) +if (icmpv6_codes[i].type == icmptype && + icmpv6_codes[i].code_min == code_min && + icmpv6_codes[i].code_max == code_max) +break ; + +xt_xlate_add (xl, icmpv6_codes[i].name); +} + +static int icmp6_xlate (const struct xt_entry_match *match,struct xt_xlate *xl, +int numeric) +{ +const struct ip6t_icmp *info = (struct ip6t_icmp *)match->data; + +xt_xlate_add (xl,"icmpv6 type%s " , + (info->invflags &IP6T_ICMP_INV )?" !=" :"" ); + +type_xlate_print (xl, info->type, info->code[0 ], info->code[1 ]); + +xt_xlate_add (xl," " ); + +return 1 ; +} +static struct xtables_match icmp6_mt6_reg = { .name ="icmp6" , .version =XTABLES_VERSION ,
@@ -234,6 +263,7 @@ static struct xtables_match icmp6_mt6_reg = { .save = icmp6_save, .x6_parse = icmp6_parse, .x6_options = icmp6_opts, + .xlate = icmp6_xlate, };void _init (void )
Signature · 1 line
2.7.0