extensions: libipt_icmp: Add translation to nft

PATCH Superseded Laura Garcia Liebana 3 participants 8 messages Mar 6, 2016 – Mar 7, 2016 netfilter

Share & tools

Laura Garcia Liebana

author

2016-03-06 22:24 UTC #0 lore raw

PATCH v2 1/1 extensions: libipt_icmp: Add translation to nft

Add translation for icmp to nftables. Not supported types in nftables
are: any, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, router-advertisement, router-solicitation, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing.

Examples:

$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG
nft add rule ip filter INPUT icmp type echo-reply counter log level warn

$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn

$ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn

Signed-off-by Laura Garcia Liebana <[email protected]>

---
v2:
- Detection of not supported types in nftables, as Shivani suggested.

 extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

extensions/libipt_icmp.c +45 -1

index 666e7da..89eb36e 100644
@@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type,
 }
 
 static void icmp_print(const void *ip, const struct xt_entry_match *match,
-                       int numeric)
+		       int numeric)
 {
 	const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;

@@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
+static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
+			     unsigned int code_min, unsigned int code_max)
+{
+	unsigned int i;
+
+	if (code_min == code_max)
+		return 0;
+
+	switch (icmptype) {
+	case 0xFF:
+	case 9:
+	case 10:
+		return 0;
+	default:
+		for (i = 0; ARRAY_SIZE(icmp_codes); ++i)
+			if (icmp_codes[i].type == icmptype &&
+			    icmp_codes[i].code_min == code_min &&
+			    icmp_codes[i].code_max == code_max)
+				break;
+
+			xt_xlate_add(xl, icmp_codes[i].name);
+	}
+
+	return 1;
+}
+
+static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl,
+		       int numeric)
+{
+	const struct ipt_icmp *info = (struct ipt_icmp *)match->data;
+
+	xt_xlate_add(xl, "icmp type%s ",
+		     (info->invflags & IPT_ICMP_INV) ? " !=" : "");
+
+	if (!type_xlate_print(xl, info->type, info->code[0], info->code[1]))
+		return 0;
+
+	xt_xlate_add(xl, " ");
+
+	return 1;
+}
+
+
 static struct xtables_match icmp_mt_reg = {
 	.name		= "icmp",
 	.version	= XTABLES_VERSION,

@@ -261,6 +304,7 @@ static struct xtables_match icmp_mt_reg = {
 	.save		= icmp_save,
 	.x6_parse	= icmp_parse,
 	.x6_options	= icmp_opts,
+	.xlate		= icmp_xlate,
 };
 
 void _init(void)

Signature · 1 line

2.7.0

Pablo Neira Ayuso

maintainer

2016-03-07 16:58 UTC #1 lore raw

Quoted 9 lines · Laura Garcia Liebana

Add translation for icmp to nftables. Not supported types in nftables
are: any, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, router-advertisement, router-solicitation, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing.

Oh I see, these are actually the non-supported icmp codes at this moment, instead of the icmp types.

All icmp types should work, if any missing, we should add them. For icmp codes, we need a fix for the listing side of nft.

Then, please return 0 when icmp codes are specified by now, document this in the wiki and here in the description.

Thanks.

Pablo Neira Ayuso

maintainer

2016-03-07 17:14 UTC #2 lore raw

In reply to Laura Garcia Liebana

Quoted 48 lines · Laura Garcia Liebana

Add translation for icmp to nftables. Not supported types in nftables
are: any, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, router-advertisement, router-solicitation, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing.
Examples:
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG
nft add rule ip filter INPUT icmp type echo-reply counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn
Signed-off-by Laura Garcia Liebana <[email protected]>
---
v2:
- Detection of not supported types in nftables, as Shivani suggested.
 extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)
extensions/libipt_icmp.c +3 -1
index 666e7da..89eb36e 100644
@@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type,
 }
 
 static void icmp_print(const void *ip, const struct xt_entry_match *match,
-                       int numeric)
+		       int numeric)
 {
 	const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
 
@@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
+static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
+			     unsigned int code_min, unsigned int code_max)

extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 263

Quoted 10 lines

extensions/libipt_icmp.c +10 -0

+{
+	unsigned int i;
+
+	if (code_min == code_max)
+		return 0;
+
+	switch (icmptype) {
+	case 0xFF:
+	case 9:
+	case 10:

Why are we skipping these here?

extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 266

Quoted 3 lines

extensions/libipt_icmp.c +3 -0

+		return 0;
+	default:
+		for (i = 0; ARRAY_SIZE(icmp_codes); ++i)

Missing bracket here.

extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 272

Quoted 6 lines

extensions/libipt_icmp.c +6 -0

+			if (icmp_codes[i].type == icmptype &&
+			    icmp_codes[i].code_min == code_min &&
+			    icmp_codes[i].code_max == code_max)
+				break;
+
+			xt_xlate_add(xl, icmp_codes[i].name);

Same thing. But as I said in the previous patch, are you sure you need this code snippet above at this stage?

Quoted 36 lines

extensions/libipt_icmp.c +23 -0

+	}
+
+	return 1;
+}
+
+static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl,
+		       int numeric)
+{
+	const struct ipt_icmp *info = (struct ipt_icmp *)match->data;
+
+	xt_xlate_add(xl, "icmp type%s ",
+		     (info->invflags & IPT_ICMP_INV) ? " !=" : "");
+
+	if (!type_xlate_print(xl, info->type, info->code[0], info->code[1]))
+		return 0;
+
+	xt_xlate_add(xl, " ");
+
+	return 1;
+}
+
+
 static struct xtables_match icmp_mt_reg = {
 	.name		= "icmp",
 	.version	= XTABLES_VERSION,

@@ -261,6 +304,7 @@ static struct xtables_match icmp_mt_reg = {
 	.save		= icmp_save,
 	.x6_parse	= icmp_parse,
 	.x6_options	= icmp_opts,
+	.xlate		= icmp_xlate,
 };
 
 void _init(void)

Signature · 1 line

2.7.0

Laura Garcia

author

2016-03-07 18:04 UTC #3 lore raw

Quoted 47 lines · Pablo Neira Ayuso

Quoted 46 lines · Laura Garcia Liebana
Add translation for icmp to nftables. Not supported types in nftables
are: any, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, router-advertisement, router-solicitation, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing.
Examples:
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG
nft add rule ip filter INPUT icmp type echo-reply counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn
Signed-off-by Laura Garcia Liebana <[email protected]>
---
v2:
- Detection of not supported types in nftables, as Shivani suggested.
 extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)
extensions/libipt_icmp.c +1 -1
index 666e7da..89eb36e 100644
@@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type,
 }
 
 static void icmp_print(const void *ip, const struct xt_entry_match *match,
-                       int numeric)
+		       int numeric)
 {
 	const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
 
@@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 

Quoted 15 lines

extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 263
Quoted 12 lines
extensions/libipt_icmp.c +12 -0
+static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
+			     unsigned int code_min, unsigned int code_max)
+{
+	unsigned int i;
+
+	if (code_min == code_max)
+		return 0;
+
+	switch (icmptype) {
+	case 0xFF:
+	case 9:
+	case 10:
Why are we skipping these here?

These are types which doesn't seem to be supported by nftables: any, router-advertisement and router-solicitation, so in this case we would return a 0 in order to indicate that the translation is not supported.

Quoted 6 lines

extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 266
Quoted 3 lines
extensions/libipt_icmp.c +3 -0
+		return 0;
+	default:
+		for (i = 0; ARRAY_SIZE(icmp_codes); ++i)
Missing bracket here.

Quoted 10 lines

extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 272
Quoted 6 lines
extensions/libipt_icmp.c +6 -0
+			if (icmp_codes[i].type == icmptype &&
+			    icmp_codes[i].code_min == code_min &&
+			    icmp_codes[i].code_max == code_max)
+				break;
+
+			xt_xlate_add(xl, icmp_codes[i].name);
Same thing. But as I said in the previous patch, are you sure you need this code snippet above at this stage?

The brackets are not missing here, sorry for the confusion. Inside the for statement we only have the condition. Just the xt_late_add function indentation is not correct.

This code it's needed in order to translate from types numbers to type names, but we're ensuring after that which types names are similar in iptables and nftables. For example, with this code we get:

$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn

Without this code:

$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type 3 counter log level warn

Quoted 36 lines

extensions/libipt_icmp.c +23 -0

+	}
+
+	return 1;
+}
+
+static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl,
+		       int numeric)
+{
+	const struct ipt_icmp *info = (struct ipt_icmp *)match->data;
+
+	xt_xlate_add(xl, "icmp type%s ",
+		     (info->invflags & IPT_ICMP_INV) ? " !=" : "");
+
+	if (!type_xlate_print(xl, info->type, info->code[0], info->code[1]))
+		return 0;
+
+	xt_xlate_add(xl, " ");
+
+	return 1;
+}
+
+
 static struct xtables_match icmp_mt_reg = {
 	.name		= "icmp",
 	.version	= XTABLES_VERSION,

@@ -261,6 +304,7 @@ static struct xtables_match icmp_mt_reg = {
 	.save		= icmp_save,
 	.x6_parse	= icmp_parse,
 	.x6_options	= icmp_opts,
+	.xlate		= icmp_xlate,
 };
 
 void _init(void)

Signature · 1 line

2.7.0

Shivani Bhardwaj

2016-03-07 18:10 UTC #4 lore raw

Quoted 92 lines · Laura Garcia

Quoted 47 lines · Pablo Neira Ayuso
Quoted 46 lines · Laura Garcia Liebana
Add translation for icmp to nftables. Not supported types in nftables
are: any, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, router-advertisement, router-solicitation, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing.
Examples:
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG
nft add rule ip filter INPUT icmp type echo-reply counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn
Signed-off-by Laura Garcia Liebana <[email protected]>
---
v2:
- Detection of not supported types in nftables, as Shivani suggested.
 extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)
extensions/libipt_icmp.c +1 -1
index 666e7da..89eb36e 100644
@@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type,
 }
 
 static void icmp_print(const void *ip, const struct xt_entry_match *match,
-                       int numeric)
+                  int numeric)
 {
    const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
 
@@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match)
    }
 }
 
Quoted 15 lines
extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 263
Quoted 12 lines
extensions/libipt_icmp.c +12 -0
+static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
+                        unsigned int code_min, unsigned int code_max)
+{
+   unsigned int i;
+
+   if (code_min == code_max)
+           return 0;
+
+   switch (icmptype) {
+   case 0xFF:
+   case 9:
+   case 10:
Why are we skipping these here?
These are types which doesn't seem to be supported by nftables: any, router-advertisement and router-solicitation, so in this case we would return a 0 in order to indicate that the translation is not supported.
Quoted 13 lines
extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 266
Quoted 3 lines
extensions/libipt_icmp.c +3 -0
+           return 0;
+   default:
+           for (i = 0; ARRAY_SIZE(icmp_codes); ++i)
Missing bracket here.
extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 272
Quoted 6 lines
extensions/libipt_icmp.c +6 -0
+                   if (icmp_codes[i].type == icmptype &&
+                       icmp_codes[i].code_min == code_min &&
+                       icmp_codes[i].code_max == code_max)
+                           break;
+
+                   xt_xlate_add(xl, icmp_codes[i].name);
Quoted 3 lines
Same thing. But as I said in the previous patch, are you sure you need this code snippet above at this stage?
The brackets are not missing here, sorry for the confusion. Inside the for statement we only have the condition. Just the xt_late_add function indentation is not correct.
This code it's needed in order to translate from types numbers to type names, but we're ensuring after that which types names are similar in iptables and nftables. For example, with this code we get:

Quoted 8 lines

$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn

Without this code:

$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type 3 counter log level warn

This looks good too. nftables is anyway going to convert it to its name type (if available). See how this above rule shows up in the chain:

table ip filter {
    chain INPUT {
        type filter hook input priority 0; policy accept;
        icmp type destination-unreachable counter packets 0 bytes 0 log
    }
}

But, anyway, wait for Pablo's comments about this.

Quoted 37 lines

extensions/libipt_icmp.c +23 -1

+   }
+
+   return 1;
+}
+
+static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl,
+                  int numeric)
+{
+   const struct ipt_icmp *info = (struct ipt_icmp *)match->data;
+
+   xt_xlate_add(xl, "icmp type%s ",
+                (info->invflags & IPT_ICMP_INV) ? " !=" : "");
+
+   if (!type_xlate_print(xl, info->type, info->code[0], info->code[1]))
+           return 0;
+
+   xt_xlate_add(xl, " ");
+
+   return 1;
+}
+
+
 static struct xtables_match icmp_mt_reg = {
    .name           = "icmp",
    .version        = XTABLES_VERSION,

@@ -261,6 +304,7 @@ static struct xtables_match icmp_mt_reg = {
    .save           = icmp_save,
    .x6_parse       = icmp_parse,
    .x6_options     = icmp_opts,
+   .xlate          = icmp_xlate,
 };
 
 void _init(void)
--

2.7.0

Pablo Neira Ayuso

maintainer

2016-03-07 18:27 UTC #5 lore raw

Quoted 22 lines · Shivani Bhardwaj

Quoted 9 lines · Laura Garcia
Quoted 1 line · Pablo Neira Ayuso
On Sun, Mar 06, 2016 at 11:24:44PM +0100, Laura Garcia Liebana wrote:
The brackets are not missing here, sorry for the confusion. Inside the for statement we only have the condition. Just the xt_late_add function indentation is not correct.
This code it's needed in order to translate from types numbers to type names, but we're ensuring after that which types names are similar in iptables and nftables. For example, with this code we get:
Quoted 8 lines
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn
Without this code:
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type 3 counter log level warn
This looks good too. nftables is anyway going to convert it to its name type (if available). See how this above rule shows up in the chain:

Quoted 8 lines

table ip filter {
    chain INPUT {
        type filter hook input priority 0; policy accept;
        icmp type destination-unreachable counter packets 0 bytes 0 log
    }
}

But, anyway, wait for Pablo's comments about this.

Translation to text is better, if possible.

Pablo Neira Ayuso

maintainer

2016-03-07 18:20 UTC #6 lore raw

In reply to Laura Garcia

Quoted 64 lines · Laura Garcia

Quoted 47 lines · Pablo Neira Ayuso
Quoted 46 lines · Laura Garcia Liebana
Add translation for icmp to nftables. Not supported types in nftables
are: any, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, router-advertisement, router-solicitation, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing.
Examples:
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG
nft add rule ip filter INPUT icmp type echo-reply counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn
Signed-off-by Laura Garcia Liebana <[email protected]>
---
v2:
- Detection of not supported types in nftables, as Shivani suggested.
 extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)
extensions/libipt_icmp.c +1 -1
index 666e7da..89eb36e 100644
@@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type,
 }
 
 static void icmp_print(const void *ip, const struct xt_entry_match *match,
-                       int numeric)
+		       int numeric)
 {
 	const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
 
@@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match)
 	}
 }
 
Quoted 15 lines
extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 263
Quoted 12 lines
extensions/libipt_icmp.c +12 -0
+static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
+			     unsigned int code_min, unsigned int code_max)
+{
+	unsigned int i;
+
+	if (code_min == code_max)
+		return 0;
+
+	switch (icmptype) {
+	case 0xFF:
+	case 9:
+	case 10:
Why are we skipping these here?

Quoted 3 lines

These are types which doesn't seem to be supported by nftables: any, router-advertisement and router-solicitation, so in this case we would return a 0 in order to indicate that the translation is not supported.

I think you can add these two to icmp_type_tbl in nft/src/proto.c, it would be just a two-liner to support ICMP_ROUTERADVERT and ICMP_ROUTERSOLICIT.

Regarding 'any', you can just skip translating this. From ip_tables kernel code I can see this just return true in case 0xff is specified. so the right translation to me is not to print anything.

Quoted 17 lines

Quoted 6 lines
extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 266
Quoted 3 lines
extensions/libipt_icmp.c +3 -0
+		return 0;
+	default:
+		for (i = 0; ARRAY_SIZE(icmp_codes); ++i)
Missing bracket here.
Quoted 10 lines
extensions/libipt_icmp.c static void icmp_save(const void *ip, const struct xt_entry_match *match) · line 272
Quoted 6 lines
extensions/libipt_icmp.c +6 -0
+			if (icmp_codes[i].type == icmptype &&
+			    icmp_codes[i].code_min == code_min &&
+			    icmp_codes[i].code_max == code_max)
+				break;
+
+			xt_xlate_add(xl, icmp_codes[i].name);
Same thing. But as I said in the previous patch, are you sure you need this code snippet above at this stage?

Quoted 2 lines

The brackets are not missing here, sorry for the confusion. Inside the for statement we only have the condition. Just the xt_late_add function indentation is not correct.

OK, makes sense.

Then fix this broken indent and resubmit a v2, thanks Laura.

Laura Garcia

author

2016-03-07 18:50 UTC #7 lore raw

Quoted 5 lines · Pablo Neira Ayuso

I think you can add these two to icmp_type_tbl in nft/src/proto.c, it would be just a two-liner to support ICMP_ROUTERADVERT and ICMP_ROUTERSOLICIT.

Ok, thanks!