extensions: libip6t_REJECT: Add translation to nft
PATCH 1/1 extensions: libip6t_REJECT: Add translation to nft
Add translation for target REJECT to nftables.
Examples:
$ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT --reject-with icmp6-reject-route nft add rule ip6 filter FORWARD tcp dport 22 counter reject with icmpv6 type reject-route
$ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT --reject-with tcp-reset nft add rule ip6 filter FORWARD tcp dport 22 counter reject with tcp reset
--- extensions/libip6t_REJECT.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)
extensions/libip6t_REJECT.c +38 -0
@@ -17,6 +17,11 @@ struct reject_names {const char *desc; }; +struct reject_names_xlate { +const char *name; +enum ip6t_reject_with with; +}; +enum {O_REJECT_WITH =0 , };
@@ -124,6 +129,38 @@ static void REJECT_save(const void *ip, const struct xt_entry_target *target)printf (" --reject-with %s" , reject_table[i].name); } +static const struct reject_names_xlate reject_table_xlate[] = { + {"no-route" ,IP6T_ICMP6_NO_ROUTE }, + {"admin-prohibited" ,IP6T_ICMP6_ADM_PROHIBITED }, +#if 0 + {"not-neighbour" ,IP6T_ICMP6_NOT_NEIGHBOR }, +#endif + {"addr-unreachable" ,IP6T_ICMP6_ADDR_UNREACH }, + {"port-unreachable" ,IP6T_ICMP6_PORT_UNREACH }, + {"tcp reset" ,IP6T_TCP_RESET }, + {"policy-fail" ,IP6T_ICMP6_POLICY_FAIL }, + {"reject-route" ,IP6T_ICMP6_REJECT_ROUTE } +}; + +static int REJECT_xlate (const struct xt_entry_target *target, +struct xt_buf *buf,int numeric) +{ +const struct ip6t_reject_info *reject = + (const struct ip6t_reject_info *)target->data; +unsigned int i; + +for (i =0 ; i <ARRAY_SIZE (reject_table_xlate); ++i) +if (reject_table_xlate[i].with == reject->with) +break ; +if (reject->with ==IP6T_TCP_RESET ) +xt_buf_add (buf,"reject with %s" , reject_table_xlate[i].name); +else +xt_buf_add (buf,"reject with icmpv6 type %s" , + reject_table_xlate[i].name); + +return 1 ; +} +static struct xtables_target reject_tg6_reg = { .name ="REJECT" , .version =XTABLES_VERSION ,
@@ -136,6 +173,7 @@ static struct xtables_target reject_tg6_reg = { .save = REJECT_save, .x6_parse = REJECT_parse, .x6_options = REJECT_opts, + .xlate = REJECT_xlate, };void _init (void )
Signature · 1 line
1.9.1
extensions/libip6t_REJECT.c static void REJECT_save(const void *ip, const struct xt_entry_target *target) · line 143
Quoted 13 lines · Shivani Bhardwaj
extensions/libip6t_REJECT.c +12
-0+static const struct reject_names_xlate reject_table_xlate[] = { + {"no-route" ,IP6T_ICMP6_NO_ROUTE }, + {"admin-prohibited" ,IP6T_ICMP6_ADM_PROHIBITED }, +#if 0 + {"not-neighbour" ,IP6T_ICMP6_NOT_NEIGHBOR }, +#endif + {"addr-unreachable" ,IP6T_ICMP6_ADDR_UNREACH }, + {"port-unreachable" ,IP6T_ICMP6_PORT_UNREACH }, + {"tcp reset" ,IP6T_TCP_RESET }, + {"policy-fail" ,IP6T_ICMP6_POLICY_FAIL }, + {"reject-route" ,IP6T_ICMP6_REJECT_ROUTE } +};
I wonder the reason behind including code which seems is not going to be compiled.
It was in the original extension code, perhaps you can revisit that now.
Quoted 10 lines
extensions/libip6t_REJECT.c +10
-0+ +static int REJECT_xlate (const struct xt_entry_target *target, +struct xt_buf *buf,int numeric) +{ +const struct ip6t_reject_info *reject = + (const struct ip6t_reject_info *)target->data; +unsigned int i; + +for (i =0 ; i <ARRAY_SIZE (reject_table_xlate); ++i) +if (reject_table_xlate[i].with == reject->with)
extensions/libip6t_REJECT.c static void REJECT_save(const void *ip, const struct xt_entry_target *target) · line 163
Quoted 10 lines
extensions/libip6t_REJECT.c +10
-0+break ; +if (reject->with ==IP6T_TCP_RESET ) +xt_buf_add (buf,"reject with %s" , reject_table_xlate[i].name); +else +xt_buf_add (buf,"reject with icmpv6 type %s" , + reject_table_xlate[i].name); + +return 1 ; +} +
AFAIK, -j REJECT can be used without further options. However, this _xlate() function doesn't seem to support it.
I would print unconditionally the 'reject' keyword and in case some option was used, then include the 'with XXX' thing.
i.e:
the rule:
% [...] -p tcp --dport 22 -j REJECT
translates to:
% nft add rule [...] tcp dport 22 reject
and the rule:
% [...] -p tcp --dport 22 -j REJECT --reject-with no-route translates to:
% nft add rule [...] tcp dport 22 reject with icmpv6 type no-route
Signature · 5 lines
Arturo Borrero González -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 19 lines · Arturo Borrero Gonzalez
extensions/libip6t_REJECT.c static void REJECT_save(const void *ip, const struct xt_entry_target *target) · line 143
Quoted 13 lines · Shivani Bhardwaj
extensions/libip6t_REJECT.c +12
-0+static const struct reject_names_xlate reject_table_xlate[] = { + {"no-route" ,IP6T_ICMP6_NO_ROUTE }, + {"admin-prohibited" ,IP6T_ICMP6_ADM_PROHIBITED }, +#if 0 + {"not-neighbour" ,IP6T_ICMP6_NOT_NEIGHBOR }, +#endif + {"addr-unreachable" ,IP6T_ICMP6_ADDR_UNREACH }, + {"port-unreachable" ,IP6T_ICMP6_PORT_UNREACH }, + {"tcp reset" ,IP6T_TCP_RESET }, + {"policy-fail" ,IP6T_ICMP6_POLICY_FAIL }, + {"reject-route" ,IP6T_ICMP6_REJECT_ROUTE } +};I wonder the reason behind including code which seems is not going to be compiled.
It was in the original extension code, perhaps you can revisit that now.
Hi Arturo,
I've removed the if endif block. Thanks for pointing out. If you're referring to some other thing please let me know.
Quoted 24 lines
Quoted 10 lines
extensions/libip6t_REJECT.c +10
-0+ +static int REJECT_xlate (const struct xt_entry_target *target, +struct xt_buf *buf,int numeric) +{ +const struct ip6t_reject_info *reject = + (const struct ip6t_reject_info *)target->data; +unsigned int i; + +for (i =0 ; i <ARRAY_SIZE (reject_table_xlate); ++i) +if (reject_table_xlate[i].with == reject->with)extensions/libip6t_REJECT.c static void REJECT_save(const void *ip, const struct xt_entry_target *target) · line 163
Quoted 10 lines
extensions/libip6t_REJECT.c +10
-0+break ; +if (reject->with ==IP6T_TCP_RESET ) +xt_buf_add (buf,"reject with %s" , reject_table_xlate[i].name); +else +xt_buf_add (buf,"reject with icmpv6 type %s" , + reject_table_xlate[i].name); + +return 1 ; +} +AFAIK, -j REJECT can be used without further options. However, this
_xlate()function doesn't seem to support it.
Quoted 3 lines
I would print unconditionally the 'reject' keyword and in case some option was used, then include the 'with XXX' thing.
In the reject module for ip, port unreachable is mentioned as the default option if the reject target is called.
static const struct reject_names reject_table[] = {
...
{"icmp-port-unreachable", "port-unreach",
IPT_ICMP_PORT_UNREACHABLE, "ICMP port unreachable (default)"}
...
}
Same is happening in case of ipv6. Should I be removing this default nature of both of them?
Thank you
Quoted 7 lines
i.e:
the rule:
% [...] -p tcp --dport 22 -j REJECT
translates to:
% nft add rule [...] tcp dport 22 reject
Quoted 7 lines
and the rule:
% [...] -p tcp --dport 22 -j REJECT --reject-with no-route translates to:
% nft add rule [...] tcp dport 22 reject with icmpv6 type no-route--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Arturo Borrero Gonzalez
Acked-byQuoted 60 lines · Shivani Bhardwaj
Quoted 19 lines · Arturo Borrero Gonzalez
extensions/libip6t_REJECT.c static void REJECT_save(const void *ip, const struct xt_entry_target *target) · line 143
Quoted 13 lines · Shivani Bhardwaj
extensions/libip6t_REJECT.c +12
-0+static const struct reject_names_xlate reject_table_xlate[] = { + {"no-route" ,IP6T_ICMP6_NO_ROUTE }, + {"admin-prohibited" ,IP6T_ICMP6_ADM_PROHIBITED }, +#if 0 + {"not-neighbour" ,IP6T_ICMP6_NOT_NEIGHBOR }, +#endif + {"addr-unreachable" ,IP6T_ICMP6_ADDR_UNREACH }, + {"port-unreachable" ,IP6T_ICMP6_PORT_UNREACH }, + {"tcp reset" ,IP6T_TCP_RESET }, + {"policy-fail" ,IP6T_ICMP6_POLICY_FAIL }, + {"reject-route" ,IP6T_ICMP6_REJECT_ROUTE } +};I wonder the reason behind including code which seems is not going to be compiled.
It was in the original extension code, perhaps you can revisit that now.Hi Arturo,
I've removed the if endif block. Thanks for pointing out. If you're referring to some other thing please let me know.
Quoted 24 lines
Quoted 10 lines
extensions/libip6t_REJECT.c +10
-0+ +static int REJECT_xlate (const struct xt_entry_target *target, +struct xt_buf *buf,int numeric) +{ +const struct ip6t_reject_info *reject = + (const struct ip6t_reject_info *)target->data; +unsigned int i; + +for (i =0 ; i <ARRAY_SIZE (reject_table_xlate); ++i) +if (reject_table_xlate[i].with == reject->with)extensions/libip6t_REJECT.c static void REJECT_save(const void *ip, const struct xt_entry_target *target) · line 163
Quoted 10 lines
extensions/libip6t_REJECT.c +10
-0+break ; +if (reject->with ==IP6T_TCP_RESET ) +xt_buf_add (buf,"reject with %s" , reject_table_xlate[i].name); +else +xt_buf_add (buf,"reject with icmpv6 type %s" , + reject_table_xlate[i].name); + +return 1 ; +} +AFAIK, -j REJECT can be used without further options. However, this
_xlate()function doesn't seem to support it.Quoted 3 lines
I would print unconditionally the 'reject' keyword and in case some option was used, then include the 'with XXX' thing.
In the reject module for ip, port unreachable is mentioned as the default option if the reject target is called.
static const struct
reject_namesreject_table[] = {
...
{"icmp-port-unreachable", "port-unreach",
Quoted 7 lines
IPT_ICMP_PORT_UNREACHABLE, "ICMP port unreachable (default)"}...
}Same is happening in case of ipv6. Should I be removing this default nature of both of them?
Ok,
reading now the code in depth, I see there is no way the _xlate() can get a REJECT target without the 'with' option.
So your patch looks good.
Signature · 5 lines
Arturo Borrero González -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html