extensions: libip6t_hbh: Add translation to nft
PATCH 1/1 extensions: libip6t_hbh: Add translation to nft
Add translation for Hop-By-Hop header to nftables. Hbh options are not supported yet in nft.
$ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22 nft add rule ip6 filter INPUT hbh hdrlength 22 counter
$ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22 nft add rule ip6 filter INPUT hbh hdrlength != 22 counter
--- extensions/libip6t_hbh.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
extensions/libip6t_hbh.c +17 -0
@@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)print_options (optinfo->optsnr, (uint16_t *)optinfo->opts); } +static int hbh_xlate (const void *ip,const struct xt_entry_match *match, +struct xt_xlate *xl,int numeric) +{ +const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; + +if (!(optinfo->flags &IP6T_OPTS_LEN ) || + (optinfo->flags &IP6T_OPTS_OPTS )) +return 0 ; + +xt_xlate_add (xl,"hbh hdrlength %s%u " , + (optinfo->invflags &IP6T_OPTS_INV_LEN ) ?"!= " :"" , + optinfo->hdrlen); + +return 1 ; +} +static struct xtables_match hbh_mt6_reg = { .name ="hbh" , .version =XTABLES_VERSION ,
@@ -175,6 +191,7 @@ static struct xtables_match hbh_mt6_reg = { .save = hbh_save, .x6_parse = hbh_parse, .x6_options = hbh_opts, + .xlate = hbh_xlate, };void
Signature · 1 line
2.7.0
Quoted 2 lines · Laura Garcia Liebana
Add translation for Hop-By-Hop header to nftables. Hbh options are not supported yet in nft.
It would be good to document this in the wiki, as Shivani did already. It would be also good if you can document what is missing to be capable of matching these hbh options there.
Quoted 5 lines
$ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22 nft add rule ip6 filter INPUT hbh hdrlength 22 counter$ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22 nft add rule ip6 filter INPUT hbh hdrlength != 22 counter
Applied, thanks Laura.
Quoted 8 lines · Pablo Neira Ayuso
Quoted 2 lines · Laura Garcia Liebana
Add translation for Hop-By-Hop header to nftables. Hbh options are not supported yet in nft.
It would be good to document this in the wiki, as Shivani did already. It would be also good if you can document what is missing to be capable of matching these hbh options there.
It seems that is already documented in the official wiki.
ip6
hbh
[Waiting for support of options] (partial translations available)