extensions: libip6t_hbh: Add translation to nft

PATCH Superseded Shivani Bhardwaj 2 participants 4 messages Mar 1, 2016 – Mar 9, 2016 netfilter

Share & tools

Shivani Bhardwaj

author

2016-03-01 21:52 UTC #0 lore raw

PATCH 1/1 extensions: libip6t_hbh: Add translation to nft

Add translation for module hop-by-hop to nftables.
Full translation of this match awaits the support for --hbh-opts option.

Examples:

$ sudo ip6tables-translate -A INPUT -m hbh --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength 33 counter

$ sudo ip6tables-translate -A INPUT -m hbh ! --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength != 33 counter

Signed-off-by Shivani Bhardwaj <[email protected]>

---
 extensions/libip6t_hbh.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

extensions/libip6t_hbh.c +17 -0

index c0389ed..f968036 100644
@@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
 	print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
 }
 
+static int hbh_xlate(const struct xt_entry_match *match,
+		     struct xt_xlate *xl, int numeric)
+{
+	const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
+
+	xt_xlate_add(xl, "hbh ");
+
+	if (optinfo->flags & IP6T_OPTS_LEN) {
+		xt_xlate_add(xl, "hdrlength%s %u ",
+			     optinfo->invflags & IP6T_OPTS_INV_LEN ? " !=" : "",
+			     optinfo->hdrlen);
+	}
+
+	return 1;
+}
+
 static struct xtables_match hbh_mt6_reg = {
 	.name 		= "hbh",
 	.version	= XTABLES_VERSION,

@@ -175,6 +191,7 @@ static struct xtables_match hbh_mt6_reg = {
 	.save		= hbh_save,
 	.x6_parse	= hbh_parse,
 	.x6_options	= hbh_opts,
+	.xlate		= hbh_xlate,
 };
 
 void

Signature · 1 line

1.9.1

Pablo Neira Ayuso

maintainer

2016-03-02 11:49 UTC #1 lore raw

Quoted 22 lines · Shivani Bhardwaj

Add translation for module hop-by-hop to nftables.
Full translation of this match awaits the support for --hbh-opts option.

Examples:

$ sudo ip6tables-translate -A INPUT -m hbh --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength 33 counter

$ sudo ip6tables-translate -A INPUT -m hbh ! --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength != 33 counter

Signed-off-by Shivani Bhardwaj <[email protected]>

---
 extensions/libip6t_hbh.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

extensions/libip6t_hbh.c +0 -0

index c0389ed..f968036 100644
@@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
 	print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);

extensions/libip6t_hbh.c static void hbh_save(const void *ip, const struct xt_entry_match *match) · line 174

Quoted 10 lines

extensions/libip6t_hbh.c +8 -0

 }
 
+static int hbh_xlate(const struct xt_entry_match *match,
+		     struct xt_xlate *xl, int numeric)
+{
+	const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
+
+	xt_xlate_add(xl, "hbh ");
+
+	if (optinfo->flags & IP6T_OPTS_LEN) {

If no header length is passed, then this will print:

nft add rule ip6 filter INPUT hbh counter

which will not work.

Shivani Bhardwaj

author

2016-03-02 13:48 UTC #2 lore raw

Quoted 36 lines · Pablo Neira Ayuso

Quoted 22 lines · Shivani Bhardwaj
Add translation for module hop-by-hop to nftables.
Full translation of this match awaits the support for --hbh-opts option.
Examples:
$ sudo ip6tables-translate -A INPUT -m hbh --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength 33 counter
$ sudo ip6tables-translate -A INPUT -m hbh ! --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength != 33 counter
Signed-off-by Shivani Bhardwaj <[email protected]>
---
 extensions/libip6t_hbh.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
extensions/libip6t_hbh.c +0 -0
index c0389ed..f968036 100644
@@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
      print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
extensions/libip6t_hbh.c static void hbh_save(const void *ip, const struct xt_entry_match *match) · line 174
Quoted 10 lines
extensions/libip6t_hbh.c +8 -0
 }
 
+static int hbh_xlate(const struct xt_entry_match *match,
+                  struct xt_xlate *xl, int numeric)
+{
+     const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
+
+     xt_xlate_add(xl, "hbh ");
+
+     if (optinfo->flags & IP6T_OPTS_LEN) {
If no header length is passed, then this will print:

Quoted 2 lines

nft add rule ip6 filter INPUT hbh counter

What should be the rule generated in case none of the options is mentioned?

# iptables-translate -A INPUT -m hbh
?

Quoted 1 line

which will not work.

Pablo Neira Ayuso

maintainer

2016-03-09 19:01 UTC #3 lore raw

Quoted 37 lines · Shivani Bhardwaj

Quoted 36 lines · Pablo Neira Ayuso
Quoted 22 lines · Shivani Bhardwaj
Add translation for module hop-by-hop to nftables.
Full translation of this match awaits the support for --hbh-opts option.
Examples:
$ sudo ip6tables-translate -A INPUT -m hbh --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength 33 counter
$ sudo ip6tables-translate -A INPUT -m hbh ! --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength != 33 counter
Signed-off-by Shivani Bhardwaj <[email protected]>
---
 extensions/libip6t_hbh.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
extensions/libip6t_hbh.c +0 -0
index c0389ed..f968036 100644
@@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
      print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
extensions/libip6t_hbh.c static void hbh_save(const void *ip, const struct xt_entry_match *match) · line 174
Quoted 10 lines
extensions/libip6t_hbh.c +8 -0
 }
 
+static int hbh_xlate(const struct xt_entry_match *match,
+                  struct xt_xlate *xl, int numeric)
+{
+     const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
+
+     xt_xlate_add(xl, "hbh ");
+
+     if (optinfo->flags & IP6T_OPTS_LEN) {
If no header length is passed, then this will print:

Quoted 7 lines

Quoted 2 lines
nft add rule ip6 filter INPUT hbh counter
What should be the rule generated in case none of the options is mentioned?
# iptables-translate -A INPUT -m hbh
?

Please, have a look at linux/net/ipv6/netfilter/ip6t_hbh.c and evaluate what is the behaviour in case -m hbh is passed with not options.