[PATCH 0/2] Add support for ttl translation

[PATCH 0/2] Add support for ttl translation

[Shivani Bhardwaj]

This patchset adds ttl translation to nftables by adding ip ttl to
the buffer everytime a ttl match is hit as it is necessary to mention
the protocol version with ttl, that is, 
$ sudo nft .. ttl 3 ..             won't work but
$ sudo nft .. ip ttl 3 ..          would work.
Also, since adding ip to the buffer in the code for ttl won't look
suitable, some amendments have been done in the nft-ipv4 code.

Shivani Bhardwaj (2):
  iptables: nft-ipv4: Add ip ttl to the buffer
  extensions: libipt_ttl: Add translation to nft

 extensions/libipt_ttl.c | 28 ++++++++++++++++++++++++++++
 iptables/nft-ipv4.c     |  3 +++
 2 files changed, 31 insertions(+)

-- 
1.9.1

[PATCH 1/2] iptables: nft-ipv4: Add ip ttl to the buffer

[Shivani Bhardwaj]

Add the string "ip ttl" to the buffer whenever a match for ttl is found as
ttl needs to be specified with the version of protocol being used.

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 iptables/nft-ipv4.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index ede8f17..684096f 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -477,6 +477,9 @@ static int nft_ipv4_xlate(const void *data, struct xt_buf *buf)
 			   inet_ntoa(cs->fw.ip.dst));
 	}
 
+	if (xlate_find_match(cs, "ttl"))
+		xt_buf_add(buf, "ip ttl ");
+
 	ret = xlate_matches(cs, buf);
 	if (!ret)
 		return ret;
-- 
1.9.1

[PATCH 2/2] extensions: libipt_ttl: Add translation to nft

[Shivani Bhardwaj]

Add translation for module ttl to nftables.

Examples:

$ sudo iptables-translate -A INPUT -m ttl --ttl-eq 3 -j ACCEPT
nft add rule ip filter INPUT ip ttl 3 counter accept

$ sudo iptables-translate -A INPUT -m ttl --ttl-gt 5 -j ACCEPT
nft add rule ip filter INPUT ip ttl \> 5 counter accept

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libipt_ttl.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/extensions/libipt_ttl.c b/extensions/libipt_ttl.c
index 5fe08cc..5df014b 100644
--- a/extensions/libipt_ttl.c
+++ b/extensions/libipt_ttl.c
@@ -100,6 +100,33 @@ static void ttl_save(const void *ip, const struct xt_entry_match *match)
 	printf(" %u", info->ttl);
 }
 
+static int ttl_xlate(const struct xt_entry_match *match,
+		     struct xt_buf *buf, int numeric)
+{
+	const struct ipt_ttl_info *info =
+			(struct ipt_ttl_info *) match->data;
+
+		switch (info->mode) {
+		case IPT_TTL_EQ:
+			xt_buf_add(buf, "%u ", info->ttl);
+			break;
+		case IPT_TTL_NE:
+			xt_buf_add(buf, "!= %u ", info->ttl);
+			break;
+		case IPT_TTL_LT:
+			xt_buf_add(buf, "\\< %u ", info->ttl);
+			break;
+		case IPT_TTL_GT:
+			xt_buf_add(buf, "\\> %u ", info->ttl);
+			break;
+		default:
+			/* error */
+			break;
+	}
+
+	return 1;
+}
+
 #define s struct ipt_ttl_info
 static const struct xt_option_entry ttl_opts[] = {
 	{.name = "ttl-lt", .id = O_TTL_LT, .excl = F_ANY, .type = XTTYPE_UINT8,
@@ -126,6 +153,7 @@ static struct xtables_match ttl_mt_reg = {
 	.x6_parse	= ttl_parse,
 	.x6_fcheck	= ttl_check,
 	.x6_options	= ttl_opts,
+	.xlate		= ttl_xlate,
 };
 
 
-- 
1.9.1

Re: [PATCH 0/2] Add support for ttl translation

[Pablo Neira Ayuso]

On Mon, Jan 04, 2016 at 10:49:10PM +0530, Shivani Bhardwaj wrote:
> This patchset adds ttl translation to nftables by adding ip ttl to
> the buffer everytime a ttl match is hit as it is necessary to mention
> the protocol version with ttl, that is, 
> $ sudo nft .. ttl 3 ..             won't work but
> $ sudo nft .. ip ttl 3 ..          would work.

This above is the right syntax.

> Also, since adding ip to the buffer in the code for ttl won't look
> suitable, some amendments have been done in the nft-ipv4 code.
>
> Shivani Bhardwaj (2):
>   iptables: nft-ipv4: Add ip ttl to the buffer

I don't think you need this change for nft-ipv4.

Re: [PATCH 0/2] Add support for ttl translation

[Shivani Bhardwaj]

On Mon, Jan 4, 2016 at 11:10 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Mon, Jan 04, 2016 at 10:49:10PM +0530, Shivani Bhardwaj wrote:
>> This patchset adds ttl translation to nftables by adding ip ttl to
>> the buffer everytime a ttl match is hit as it is necessary to mention
>> the protocol version with ttl, that is,
>> $ sudo nft .. ttl 3 ..             won't work but
>> $ sudo nft .. ip ttl 3 ..          would work.
>
> This above is the right syntax.
>
>> Also, since adding ip to the buffer in the code for ttl won't look
>> suitable, some amendments have been done in the nft-ipv4 code.
>>
>> Shivani Bhardwaj (2):
>>   iptables: nft-ipv4: Add ip ttl to the buffer
>
> I don't think you need this change for nft-ipv4.

Hi Pablo,

Should I be doing xt_buf_add("ip ttl") in the code for ttl?

Re: [PATCH 0/2] Add support for ttl translation

[Pablo Neira Ayuso]

On Mon, Jan 04, 2016 at 11:12:55PM +0530, Shivani Bhardwaj wrote:
> On Mon, Jan 4, 2016 at 11:10 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Mon, Jan 04, 2016 at 10:49:10PM +0530, Shivani Bhardwaj wrote:
> >> This patchset adds ttl translation to nftables by adding ip ttl to
> >> the buffer everytime a ttl match is hit as it is necessary to mention
> >> the protocol version with ttl, that is,
> >> $ sudo nft .. ttl 3 ..             won't work but
> >> $ sudo nft .. ip ttl 3 ..          would work.
> >
> > This above is the right syntax.
> >
> >> Also, since adding ip to the buffer in the code for ttl won't look
> >> suitable, some amendments have been done in the nft-ipv4 code.
> >>
> >> Shivani Bhardwaj (2):
> >>   iptables: nft-ipv4: Add ip ttl to the buffer
> >
> > I don't think you need this change for nft-ipv4.
> 
> Hi Pablo,
> 
> Should I be doing xt_buf_add("ip ttl") in the code for ttl?

Yes, that should be fine.