Skip to contentSkip to conversation

extensions: libip6t_hbh: Add translation to nft

PATCH Applied Laura Garcia Liebana 2 participants 3 messages Jun 1, 2016 – Jun 2, 2016 netfilter

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 extensions: libip6t_hbh: Add translation to nft

Add translation for Hop-By-Hop header to nftables. Hbh options are not supported yet in nft.

$ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength 22 counter
$ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength != 22 counter
---
 extensions/libip6t_hbh.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
extensions/libip6t_hbh.c +17 -0
index c0389ed..416681d 100644
@@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
 	print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
 }
 
+static int hbh_xlate(const void *ip, const struct xt_entry_match *match,
+		     struct xt_xlate *xl, int numeric)
+{
+	const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
+
+	if (!(optinfo->flags & IP6T_OPTS_LEN) ||
+	    (optinfo->flags & IP6T_OPTS_OPTS))
+		return 0;
+
+	xt_xlate_add(xl, "hbh hdrlength %s%u ",
+		     (optinfo->invflags & IP6T_OPTS_INV_LEN) ? "!= " : "",
+		     optinfo->hdrlen);
+
+	return 1;
+}
+
 static struct xtables_match hbh_mt6_reg = {
 	.name 		= "hbh",
 	.version	= XTABLES_VERSION,
@@ -175,6 +191,7 @@ static struct xtables_match hbh_mt6_reg = {
 	.save		= hbh_save,
 	.x6_parse	= hbh_parse,
 	.x6_options	= hbh_opts,
+	.xlate		= hbh_xlate,
 };
 
 void
Signature · 1 line
2.7.0
maintainer Applied
#1 lore raw
Quoted 2 lines · Laura Garcia Liebana

Add translation for Hop-By-Hop header to nftables. Hbh options are not supported yet in nft.

It would be good to document this in the wiki, as Shivani did already. It would be also good if you can document what is missing to be capable of matching these hbh options there.

Quoted 5 lines
$ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength 22 counter
$ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength != 22 counter

Applied, thanks Laura.

#2 lore raw
Quoted 8 lines · Pablo Neira Ayuso
Quoted 2 lines · Laura Garcia Liebana

Add translation for Hop-By-Hop header to nftables. Hbh options are not supported yet in nft.

It would be good to document this in the wiki, as Shivani did already. It would be also good if you can document what is missing to be capable of matching these hbh options there.

It seems that is already documented in the official wiki.

ip6

hbh

[Waiting for support of options] (partial translations available)