[PATCH] extensions: libxt_pkttype: Add translation to nft

[PATCH] extensions: libxt_pkttype: Add translation to nft

[Shivani Bhardwaj]

Add translation for packet type to nftables.

Examples:

$ sudo iptables-translate -A INPUT -m pkttype --pkt-type broadcast -j DROP
nft add rule ip filter INPUT pkttype broadcast counter drop

$ sudo iptables-translate -A INPUT -m pkttype ! --pkt-type unicast -j DROP
nft add rule ip filter INPUT pkttype != unicast counter drop

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libxt_pkttype.c | 36 ++++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/extensions/libxt_pkttype.c b/extensions/libxt_pkttype.c
index 1ed3b44..6b91e8a 100644
--- a/extensions/libxt_pkttype.c
+++ b/extensions/libxt_pkttype.c
@@ -102,7 +102,7 @@ static void pkttype_print(const void *ip, const struct xt_entry_match *match,
                           int numeric)
 {
 	const struct xt_pkttype_info *info = (const void *)match->data;
-	
+
 	printf(" PKTTYPE %s= ", info->invert ? "!" : "");
 	print_pkttype(info);
 }
@@ -110,11 +110,42 @@ static void pkttype_print(const void *ip, const struct xt_entry_match *match,
 static void pkttype_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_pkttype_info *info = (const void *)match->data;
-	
+
 	printf("%s --pkt-type ", info->invert ? " !" : "");
 	print_pkttype(info);
 }
 
+static const struct pkttypes supported_types_xlate[] = {
+	{"unicast", PACKET_HOST, 1, "to us"},
+	{"broadcast", PACKET_BROADCAST, 1, "to all"},
+	{"multicast", PACKET_MULTICAST, 1, "to group"},
+	};
+
+static void print_pkttype_xlate(const struct xt_pkttype_info *info,
+				struct xt_buf *buf)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(supported_types); ++i)
+		if (supported_types_xlate[i].pkttype == info->pkttype) {
+			xt_buf_add(buf, "%s ", supported_types_xlate[i].name);
+			return;
+		}
+
+	xt_buf_add(buf, "%d", info->pkttype);
+}
+
+static int pkttype_xlate(const struct xt_entry_match *match,
+			  struct xt_buf *buf, int numeric)
+{
+	const struct xt_pkttype_info *info = (const void *)match->data;
+
+	xt_buf_add(buf, "pkttype%s ", info->invert ? " !=" : "");
+	print_pkttype_xlate(info, buf);
+
+	return 1;
+}
+
 static struct xtables_match pkttype_match = {
 	.family		= NFPROTO_UNSPEC,
 	.name		= "pkttype",
@@ -126,6 +157,7 @@ static struct xtables_match pkttype_match = {
 	.save		= pkttype_save,
 	.x6_parse	= pkttype_parse,
 	.x6_options	= pkttype_opts,
+	.xlate		= pkttype_xlate,
 };
 
 void _init(void)
-- 
1.9.1

Re: [PATCH] extensions: libxt_pkttype: Add translation to nft

[Pablo Neira Ayuso]

On Wed, Dec 23, 2015 at 11:00:25PM +0530, Shivani Bhardwaj wrote:
> +static const struct pkttypes supported_types_xlate[] = {
> +	{"unicast", PACKET_HOST, 1, "to us"},
> +	{"broadcast", PACKET_BROADCAST, 1, "to all"},
> +	{"multicast", PACKET_MULTICAST, 1, "to group"},
                                        ^^^^^^^^^^^^^

Do we need these fields?

Re: [PATCH] extensions: libxt_pkttype: Add translation to nft

[Shivani Bhardwaj]

On Fri, Dec 25, 2015 at 5:45 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Dec 23, 2015 at 11:00:25PM +0530, Shivani Bhardwaj wrote:
>> +static const struct pkttypes supported_types_xlate[] = {
>> +     {"unicast", PACKET_HOST, 1, "to us"},
>> +     {"broadcast", PACKET_BROADCAST, 1, "to all"},
>> +     {"multicast", PACKET_MULTICAST, 1, "to group"},
>                                         ^^^^^^^^^^^^^
>
> Do we need these fields?

Not really. Sending v2.