Re: [PATCH] extensions: libip6t_mh: Add translation to nft

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Jan 14, 2016 at 11:10:09PM +0530, Shivani Bhardwaj wrote:
> Add translation for mobility header to nftables.
> 
> Examples:
> 
> $ sudo ip6tables-translate -A INPUT -p mh -j ACCEPT
> nft add rule ip6 filter INPUT ip6 nexthdr mobility-header counter accept
> 
> $ sudo ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT
> nft add rule ip6 filter INPUT ip6 nexthdr mobility-header mh type 1 counter accept
> 
> $ sudo ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT
> nft add rule ip6 filter INPUT ip6 nexthdr mobility-header mh type 1-3 counter accept

I think this translation will not work as the mobility header may not
be exactly the next header, in IPv6 you can get several extension
headers one after another.

By now I'd suggest:

... meta l4proto mobility-header mh type 1 counter

Anyway, the extension header expression needs some care, it would be
good to keep this documented in the wiki page.

While at this, it would be good if you can verify that our definition
in nftables matches rfc6275 (see nftables/src/exthdr.c), I already
detected wrong header definitions in the past.

It would be also good if you can go back to all your translations and
validate what we already got into the tree from the packet path, ie.
generate traffic that matches the rule in ip6tables and nftables. Note
sure if you made this checks.

Some of them should be easy to test, some other may take a while,
python scapy may help in some cases to forge and to inject a packet
with a specific layout.

Thanks.