[PATCH] extensions: libip6t_hbh: Add translation to nft

[PATCH] extensions: libip6t_hbh: Add translation to nft

[Shivani Bhardwaj]

Add translation for module hop-by-hop to nftables.
Full translation of this match awaits the support for --hbh-opts option.

Examples:

$ sudo ip6tables-translate -A INPUT -m hbh --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength 33 counter

$ sudo ip6tables-translate -A INPUT -m hbh ! --hbh-len 33
nft add rule ip6 filter INPUT hbh hdrlength != 33 counter

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libip6t_hbh.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c
index c0389ed..f968036 100644
--- a/extensions/libip6t_hbh.c
+++ b/extensions/libip6t_hbh.c
@@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
 	print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
 }
 
+static int hbh_xlate(const struct xt_entry_match *match,
+		     struct xt_xlate *xl, int numeric)
+{
+	const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
+
+	xt_xlate_add(xl, "hbh ");
+
+	if (optinfo->flags & IP6T_OPTS_LEN) {
+		xt_xlate_add(xl, "hdrlength%s %u ",
+			     optinfo->invflags & IP6T_OPTS_INV_LEN ? " !=" : "",
+			     optinfo->hdrlen);
+	}
+
+	return 1;
+}
+
 static struct xtables_match hbh_mt6_reg = {
 	.name 		= "hbh",
 	.version	= XTABLES_VERSION,
@@ -175,6 +191,7 @@ static struct xtables_match hbh_mt6_reg = {
 	.save		= hbh_save,
 	.x6_parse	= hbh_parse,
 	.x6_options	= hbh_opts,
+	.xlate		= hbh_xlate,
 };
 
 void
-- 
1.9.1

Re: [PATCH] extensions: libip6t_hbh: Add translation to nft

[Pablo Neira Ayuso]

On Wed, Mar 02, 2016 at 03:22:43AM +0530, Shivani Bhardwaj wrote:
> Add translation for module hop-by-hop to nftables.
> Full translation of this match awaits the support for --hbh-opts option.
> 
> Examples:
> 
> $ sudo ip6tables-translate -A INPUT -m hbh --hbh-len 33
> nft add rule ip6 filter INPUT hbh hdrlength 33 counter
> 
> $ sudo ip6tables-translate -A INPUT -m hbh ! --hbh-len 33
> nft add rule ip6 filter INPUT hbh hdrlength != 33 counter
>
> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
> ---
>  extensions/libip6t_hbh.c | 17 +++++++++++++++++
>  1 file changed, 17 insertions(+)
> 
> diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c
> index c0389ed..f968036 100644
> --- a/extensions/libip6t_hbh.c
> +++ b/extensions/libip6t_hbh.c
> @@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
>  	print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
>  }
>  
> +static int hbh_xlate(const struct xt_entry_match *match,
> +		     struct xt_xlate *xl, int numeric)
> +{
> +	const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
> +
> +	xt_xlate_add(xl, "hbh ");
> +
> +	if (optinfo->flags & IP6T_OPTS_LEN) {

If no header length is passed, then this will print:

nft add rule ip6 filter INPUT hbh counter

which will not work.

Re: [PATCH] extensions: libip6t_hbh: Add translation to nft

[Shivani Bhardwaj]

On Wed, Mar 2, 2016 at 5:19 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Mar 02, 2016 at 03:22:43AM +0530, Shivani Bhardwaj wrote:
>> Add translation for module hop-by-hop to nftables.
>> Full translation of this match awaits the support for --hbh-opts option.
>>
>> Examples:
>>
>> $ sudo ip6tables-translate -A INPUT -m hbh --hbh-len 33
>> nft add rule ip6 filter INPUT hbh hdrlength 33 counter
>>
>> $ sudo ip6tables-translate -A INPUT -m hbh ! --hbh-len 33
>> nft add rule ip6 filter INPUT hbh hdrlength != 33 counter
>>
>> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
>> ---
>>  extensions/libip6t_hbh.c | 17 +++++++++++++++++
>>  1 file changed, 17 insertions(+)
>>
>> diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c
>> index c0389ed..f968036 100644
>> --- a/extensions/libip6t_hbh.c
>> +++ b/extensions/libip6t_hbh.c
>> @@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
>>       print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
>>  }
>>
>> +static int hbh_xlate(const struct xt_entry_match *match,
>> +                  struct xt_xlate *xl, int numeric)
>> +{
>> +     const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
>> +
>> +     xt_xlate_add(xl, "hbh ");
>> +
>> +     if (optinfo->flags & IP6T_OPTS_LEN) {
>
> If no header length is passed, then this will print:
>
> nft add rule ip6 filter INPUT hbh counter
>

What should be the rule generated in case none of the options is mentioned?

# iptables-translate -A INPUT -m hbh
?

> which will not work.

Re: [PATCH] extensions: libip6t_hbh: Add translation to nft

[Pablo Neira Ayuso]

On Wed, Mar 02, 2016 at 07:17:36PM +0530, Shivani Bhardwaj wrote:
> On Wed, Mar 2, 2016 at 5:19 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Mar 02, 2016 at 03:22:43AM +0530, Shivani Bhardwaj wrote:
> >> Add translation for module hop-by-hop to nftables.
> >> Full translation of this match awaits the support for --hbh-opts option.
> >>
> >> Examples:
> >>
> >> $ sudo ip6tables-translate -A INPUT -m hbh --hbh-len 33
> >> nft add rule ip6 filter INPUT hbh hdrlength 33 counter
> >>
> >> $ sudo ip6tables-translate -A INPUT -m hbh ! --hbh-len 33
> >> nft add rule ip6 filter INPUT hbh hdrlength != 33 counter
> >>
> >> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
> >> ---
> >>  extensions/libip6t_hbh.c | 17 +++++++++++++++++
> >>  1 file changed, 17 insertions(+)
> >>
> >> diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c
> >> index c0389ed..f968036 100644
> >> --- a/extensions/libip6t_hbh.c
> >> +++ b/extensions/libip6t_hbh.c
> >> @@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
> >>       print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
> >>  }
> >>
> >> +static int hbh_xlate(const struct xt_entry_match *match,
> >> +                  struct xt_xlate *xl, int numeric)
> >> +{
> >> +     const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
> >> +
> >> +     xt_xlate_add(xl, "hbh ");
> >> +
> >> +     if (optinfo->flags & IP6T_OPTS_LEN) {
> >
> > If no header length is passed, then this will print:
> >
> > nft add rule ip6 filter INPUT hbh counter
> >
> 
> What should be the rule generated in case none of the options is mentioned?
> 
> # iptables-translate -A INPUT -m hbh
> ?

Please, have a look at linux/net/ipv6/netfilter/ip6t_hbh.c and
evaluate what is the behaviour in case -m hbh is passed with not
options.

[PATCH] extensions: libip6t_hbh: Add translation to nft

[Laura Garcia Liebana]

Add translation for Hop-By-Hop header to nftables. Hbh options are not
supported yet in nft.

$ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength 22 counter

$ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength != 22 counter

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
---
 extensions/libip6t_hbh.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c
index c0389ed..416681d 100644
--- a/extensions/libip6t_hbh.c
+++ b/extensions/libip6t_hbh.c
@@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match)
 	print_options(optinfo->optsnr, (uint16_t *)optinfo->opts);
 }
 
+static int hbh_xlate(const void *ip, const struct xt_entry_match *match,
+		     struct xt_xlate *xl, int numeric)
+{
+	const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data;
+
+	if (!(optinfo->flags & IP6T_OPTS_LEN) ||
+	    (optinfo->flags & IP6T_OPTS_OPTS))
+		return 0;
+
+	xt_xlate_add(xl, "hbh hdrlength %s%u ",
+		     (optinfo->invflags & IP6T_OPTS_INV_LEN) ? "!= " : "",
+		     optinfo->hdrlen);
+
+	return 1;
+}
+
 static struct xtables_match hbh_mt6_reg = {
 	.name 		= "hbh",
 	.version	= XTABLES_VERSION,
@@ -175,6 +191,7 @@ static struct xtables_match hbh_mt6_reg = {
 	.save		= hbh_save,
 	.x6_parse	= hbh_parse,
 	.x6_options	= hbh_opts,
+	.xlate		= hbh_xlate,
 };
 
 void
-- 
2.7.0

Re: [PATCH] extensions: libip6t_hbh: Add translation to nft

[Pablo Neira Ayuso]

On Thu, Jun 02, 2016 at 12:08:08AM +0200, Laura Garcia Liebana wrote:
> Add translation for Hop-By-Hop header to nftables. Hbh options are not
> supported yet in nft.

It would be good to document this in the wiki, as Shivani did already.
It would be also good if you can document what is missing to be
capable of matching these hbh options there.

> $ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22
> nft add rule ip6 filter INPUT hbh hdrlength 22 counter
> 
> $ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22
> nft add rule ip6 filter INPUT hbh hdrlength != 22 counter

Applied, thanks Laura.

Re: [PATCH] extensions: libip6t_hbh: Add translation to nft

[Laura Garcia]

On Thu, Jun 02, 2016 at 01:08:47PM +0200, Pablo Neira Ayuso wrote:
> On Thu, Jun 02, 2016 at 12:08:08AM +0200, Laura Garcia Liebana wrote:
> > Add translation for Hop-By-Hop header to nftables. Hbh options are not
> > supported yet in nft.
> 
> It would be good to document this in the wiki, as Shivani did already.
> It would be also good if you can document what is missing to be
> capable of matching these hbh options there.
>

It seems that is already documented in the official wiki.

 ip6

     hbh 

     [Waiting for support of options] (partial translations available)