Skip to contentSkip to conversation

extensions: libxt_pkttype: Add translation to nft

PATCH In review Shivani Bhardwaj 2 participants 3 messages Dec 23, 2015 – Dec 25, 2015 netfilter

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 extensions: libxt_pkttype: Add translation to nft

Add translation for packet type to nftables.

Examples:

$ sudo iptables-translate -A INPUT -m pkttype --pkt-type broadcast -j DROP
nft add rule ip filter INPUT pkttype broadcast counter drop
$ sudo iptables-translate -A INPUT -m pkttype ! --pkt-type unicast -j DROP
nft add rule ip filter INPUT pkttype != unicast counter drop
---
 extensions/libxt_pkttype.c | 36 ++++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)
extensions/libxt_pkttype.c +34 -2
index 1ed3b44..6b91e8a 100644
@@ -102,7 +102,7 @@ static void pkttype_print(const void *ip, const struct xt_entry_match *match,
                           int numeric)
 {
 	const struct xt_pkttype_info *info = (const void *)match->data;
-	
+
 	printf(" PKTTYPE %s= ", info->invert ? "!" : "");
 	print_pkttype(info);
 }
@@ -110,11 +110,42 @@ static void pkttype_print(const void *ip, const struct xt_entry_match *match,
 static void pkttype_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_pkttype_info *info = (const void *)match->data;
-	
+
 	printf("%s --pkt-type ", info->invert ? " !" : "");
 	print_pkttype(info);
 }
 
+static const struct pkttypes supported_types_xlate[] = {
+	{"unicast", PACKET_HOST, 1, "to us"},
+	{"broadcast", PACKET_BROADCAST, 1, "to all"},
+	{"multicast", PACKET_MULTICAST, 1, "to group"},
+	};
+
+static void print_pkttype_xlate(const struct xt_pkttype_info *info,
+				struct xt_buf *buf)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(supported_types); ++i)
+		if (supported_types_xlate[i].pkttype == info->pkttype) {
+			xt_buf_add(buf, "%s ", supported_types_xlate[i].name);
+			return;
+		}
+
+	xt_buf_add(buf, "%d", info->pkttype);
+}
+
+static int pkttype_xlate(const struct xt_entry_match *match,
+			  struct xt_buf *buf, int numeric)
+{
+	const struct xt_pkttype_info *info = (const void *)match->data;
+
+	xt_buf_add(buf, "pkttype%s ", info->invert ? " !=" : "");
+	print_pkttype_xlate(info, buf);
+
+	return 1;
+}
+
 static struct xtables_match pkttype_match = {
 	.family		= NFPROTO_UNSPEC,
 	.name		= "pkttype",
@@ -126,6 +157,7 @@ static struct xtables_match pkttype_match = {
 	.save		= pkttype_save,
 	.x6_parse	= pkttype_parse,
 	.x6_options	= pkttype_opts,
+	.xlate		= pkttype_xlate,
 };
 
 void _init(void)
Signature · 1 line
1.9.1
#1 lore raw

extensions/libxt_pkttype.c static void pkttype_print(const void *ip, const struct xt_entry_match *match, · line 121

Quoted 4 lines · Shivani Bhardwaj
extensions/libxt_pkttype.c +4 -0
+static const struct pkttypes supported_types_xlate[] = {
+	{"unicast", PACKET_HOST, 1, "to us"},
+	{"broadcast", PACKET_BROADCAST, 1, "to all"},
+	{"multicast", PACKET_MULTICAST, 1, "to group"},
                                        ^^^^^^^^^^^^^

Do we need these fields?

#2 lore raw
Quoted 8 lines · Pablo Neira Ayuso

extensions/libxt_pkttype.c static void pkttype_print(const void *ip, const struct xt_entry_match *match, · line 121

Quoted 4 lines · Shivani Bhardwaj
extensions/libxt_pkttype.c +4 -0
+static const struct pkttypes supported_types_xlate[] = {
+     {"unicast", PACKET_HOST, 1, "to us"},
+     {"broadcast", PACKET_BROADCAST, 1, "to all"},
+     {"multicast", PACKET_MULTICAST, 1, "to group"},
                                        ^^^^^^^^^^^^^

Do we need these fields?

Not really. Sending v2.