Skip to contentSkip to conversation

extensions: libxt_ipcomp: Add translation to nft

PATCH Applied Laura Garcia Liebana 2 participants 2 messages May 31, 2016 – Jun 1, 2016 netfilter

lore
Share & tools
lore

Laura Garcia Liebana

author
#0 lore raw

PATCH 1/1 extensions: libxt_ipcomp: Add translation to nft

Add translation of ipcomp to nftables.

First value of the parameter 'ipcompspi' will be translated to 'cpi' parameter in nftables. Parameter 'compres' is not supported in nftables.

Examples:

$ sudo iptables-translate -t filter -A INPUT -m ipcomp --ipcompspi 0x12 -j ACCEPT
nft add rule ip filter INPUT comp cpi 18 counter accept
$ sudo iptables-translate -t filter -A INPUT -m ipcomp ! --ipcompspi 0x12 -j ACCEPT
nft add rule ip filter INPUT comp cpi != 18 counter accept
Signed-off-by Laura Garcia Liebana <[email protected]>
---
 extensions/libxt_ipcomp.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)
extensions/libxt_ipcomp.c +13 -0
index b157e7b..19b251a 100644
@@ -95,6 +95,18 @@ static void comp_save(const void *ip, const struct xt_entry_match *match)
 		printf(" --compres");
 }
 
+static int comp_xlate(const void *ip, const struct xt_entry_match *match,
+			struct xt_xlate *xl, int numeric)
+{
+	const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data;
+
+	xt_xlate_add(xl, "comp cpi %s%u ",
+		     (compinfo->invflags & XT_IPCOMP_INV_SPI) ? "!= " : "",
+		     compinfo->spis[0]);
+
+	return 1;
+}
+
 static struct xtables_match comp_mt_reg = {
 	.name          = "ipcomp",
 	.version       = XTABLES_VERSION,

@@ -106,6 +118,7 @@ static struct xtables_match comp_mt_reg = {
 	.save          = comp_save,
 	.x6_parse      = comp_parse,
 	.x6_options    = comp_opts,
+	.xlate         = comp_xlate,
 };
 
 void
Signature · 1 line
2.7.0
maintainer Applied
#1 lore raw
Quoted 5 lines · Laura Garcia Liebana

Add translation of ipcomp to nftables.

First value of the parameter 'ipcompspi' will be translated to 'cpi' parameter in nftables. Parameter 'compres' is not supported in nftables.

Quoted 7 lines

Examples:

$ sudo iptables-translate -t filter -A INPUT -m ipcomp --ipcompspi 0x12 -j ACCEPT
nft add rule ip filter INPUT comp cpi 18 counter accept
$ sudo iptables-translate -t filter -A INPUT -m ipcomp ! --ipcompspi 0x12 -j ACCEPT
nft add rule ip filter INPUT comp cpi != 18 counter accept

Applied, thanks Laura.