* [PATCHv2] extensions: libipt_icmp: Add translation to nft @ 2016-03-06 22:24 Laura Garcia Liebana 2016-03-07 16:58 ` Pablo Neira Ayuso 2016-03-07 17:14 ` Pablo Neira Ayuso 0 siblings, 2 replies; 8+ messages in thread From: Laura Garcia Liebana @ 2016-03-06 22:24 UTC (permalink / raw) To: netfilter-devel; +Cc: shivanib134, pablo, outreachy-kernel Add translation for icmp to nftables. Not supported types in nftables are: any, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, router-advertisement, router-solicitation, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing. Examples: $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG nft add rule ip filter INPUT icmp type echo-reply counter log level warn $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> --- v2: - Detection of not supported types in nftables, as Shivani suggested. extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c index 666e7da..89eb36e 100644 --- a/extensions/libipt_icmp.c +++ b/extensions/libipt_icmp.c @@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type, } static void icmp_print(const void *ip, const struct xt_entry_match *match, - int numeric) + int numeric) { const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; @@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) } } +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, + unsigned int code_min, unsigned int code_max) +{ + unsigned int i; + + if (code_min == code_max) + return 0; + + switch (icmptype) { + case 0xFF: + case 9: + case 10: + return 0; + default: + for (i = 0; ARRAY_SIZE(icmp_codes); ++i) + if (icmp_codes[i].type == icmptype && + icmp_codes[i].code_min == code_min && + icmp_codes[i].code_max == code_max) + break; + + xt_xlate_add(xl, icmp_codes[i].name); + } + + return 1; +} + +static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl, + int numeric) +{ + const struct ipt_icmp *info = (struct ipt_icmp *)match->data; + + xt_xlate_add(xl, "icmp type%s ", + (info->invflags & IPT_ICMP_INV) ? " !=" : ""); + + if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) + return 0; + + xt_xlate_add(xl, " "); + + return 1; +} + + static struct xtables_match icmp_mt_reg = { .name = "icmp", .version = XTABLES_VERSION, @@ -261,6 +304,7 @@ static struct xtables_match icmp_mt_reg = { .save = icmp_save, .x6_parse = icmp_parse, .x6_options = icmp_opts, + .xlate = icmp_xlate, }; void _init(void) -- 2.7.0 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCHv2] extensions: libipt_icmp: Add translation to nft 2016-03-06 22:24 [PATCHv2] extensions: libipt_icmp: Add translation to nft Laura Garcia Liebana @ 2016-03-07 16:58 ` Pablo Neira Ayuso 2016-03-07 17:14 ` Pablo Neira Ayuso 1 sibling, 0 replies; 8+ messages in thread From: Pablo Neira Ayuso @ 2016-03-07 16:58 UTC (permalink / raw) To: Laura Garcia Liebana; +Cc: netfilter-devel, shivanib134, outreachy-kernel On Sun, Mar 06, 2016 at 11:24:44PM +0100, Laura Garcia Liebana wrote: > Add translation for icmp to nftables. Not supported types in nftables > are: any, network-unreachable, host-unreachable, protocol-unreachable, > port-unreachable, fragmentation-needed, source-route-failed, > network-unknown, host-unknown, network-prohibited, host-prohibited, > TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, > host-precedence-violation, precedence-cutoff, network-redirect, > host-redirect, TOS-network-redirect, TOS-host-redirect, > router-advertisement, router-solicitation, ttl-zero-during-transit, > ttl-zero-during-reassembly, ip-header-bad and required-option-missing. Oh I see, these are actually the non-supported icmp codes at this moment, instead of the icmp types. All icmp types should work, if any missing, we should add them. For icmp codes, we need a fix for the listing side of nft. Then, please return 0 when icmp codes are specified by now, document this in the wiki and here in the description. Thanks. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCHv2] extensions: libipt_icmp: Add translation to nft 2016-03-06 22:24 [PATCHv2] extensions: libipt_icmp: Add translation to nft Laura Garcia Liebana 2016-03-07 16:58 ` Pablo Neira Ayuso @ 2016-03-07 17:14 ` Pablo Neira Ayuso 2016-03-07 18:04 ` Laura Garcia 1 sibling, 1 reply; 8+ messages in thread From: Pablo Neira Ayuso @ 2016-03-07 17:14 UTC (permalink / raw) To: Laura Garcia Liebana; +Cc: netfilter-devel, shivanib134, outreachy-kernel On Sun, Mar 06, 2016 at 11:24:44PM +0100, Laura Garcia Liebana wrote: > Add translation for icmp to nftables. Not supported types in nftables > are: any, network-unreachable, host-unreachable, protocol-unreachable, > port-unreachable, fragmentation-needed, source-route-failed, > network-unknown, host-unknown, network-prohibited, host-prohibited, > TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, > host-precedence-violation, precedence-cutoff, network-redirect, > host-redirect, TOS-network-redirect, TOS-host-redirect, > router-advertisement, router-solicitation, ttl-zero-during-transit, > ttl-zero-during-reassembly, ip-header-bad and required-option-missing. > > Examples: > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG > nft add rule ip filter INPUT icmp type echo-reply counter log level warn > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG > nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn > > $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG > nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn > > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> > --- > v2: > - Detection of not supported types in nftables, as Shivani suggested. > > extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 45 insertions(+), 1 deletion(-) > > diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c > index 666e7da..89eb36e 100644 > --- a/extensions/libipt_icmp.c > +++ b/extensions/libipt_icmp.c > @@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type, > } > > static void icmp_print(const void *ip, const struct xt_entry_match *match, > - int numeric) > + int numeric) > { > const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; > > @@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) > } > } > > +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, > + unsigned int code_min, unsigned int code_max) > +{ > + unsigned int i; > + > + if (code_min == code_max) > + return 0; > + > + switch (icmptype) { > + case 0xFF: > + case 9: > + case 10: Why are we skipping these here? > + return 0; > + default: > + for (i = 0; ARRAY_SIZE(icmp_codes); ++i) Missing bracket here. > + if (icmp_codes[i].type == icmptype && > + icmp_codes[i].code_min == code_min && > + icmp_codes[i].code_max == code_max) > + break; > + > + xt_xlate_add(xl, icmp_codes[i].name); Same thing. But as I said in the previous patch, are you sure you need this code snippet above at this stage? > + } > + > + return 1; > +} > + > +static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl, > + int numeric) > +{ > + const struct ipt_icmp *info = (struct ipt_icmp *)match->data; > + > + xt_xlate_add(xl, "icmp type%s ", > + (info->invflags & IPT_ICMP_INV) ? " !=" : ""); > + > + if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) > + return 0; > + > + xt_xlate_add(xl, " "); > + > + return 1; > +} > + > + > static struct xtables_match icmp_mt_reg = { > .name = "icmp", > .version = XTABLES_VERSION, > @@ -261,6 +304,7 @@ static struct xtables_match icmp_mt_reg = { > .save = icmp_save, > .x6_parse = icmp_parse, > .x6_options = icmp_opts, > + .xlate = icmp_xlate, > }; > > void _init(void) > -- > 2.7.0 > ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCHv2] extensions: libipt_icmp: Add translation to nft 2016-03-07 17:14 ` Pablo Neira Ayuso @ 2016-03-07 18:04 ` Laura Garcia 2016-03-07 18:10 ` Shivani Bhardwaj 2016-03-07 18:20 ` Pablo Neira Ayuso 0 siblings, 2 replies; 8+ messages in thread From: Laura Garcia @ 2016-03-07 18:04 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel, shivanib134, outreachy-kernel On Mon, Mar 07, 2016 at 06:14:08PM +0100, Pablo Neira Ayuso wrote: > On Sun, Mar 06, 2016 at 11:24:44PM +0100, Laura Garcia Liebana wrote: > > Add translation for icmp to nftables. Not supported types in nftables > > are: any, network-unreachable, host-unreachable, protocol-unreachable, > > port-unreachable, fragmentation-needed, source-route-failed, > > network-unknown, host-unknown, network-prohibited, host-prohibited, > > TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, > > host-precedence-violation, precedence-cutoff, network-redirect, > > host-redirect, TOS-network-redirect, TOS-host-redirect, > > router-advertisement, router-solicitation, ttl-zero-during-transit, > > ttl-zero-during-reassembly, ip-header-bad and required-option-missing. > > > > Examples: > > > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG > > nft add rule ip filter INPUT icmp type echo-reply counter log level warn > > > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG > > nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn > > > > $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG > > nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn > > > > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> > > --- > > v2: > > - Detection of not supported types in nftables, as Shivani suggested. > > > > extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- > > 1 file changed, 45 insertions(+), 1 deletion(-) > > > > diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c > > index 666e7da..89eb36e 100644 > > --- a/extensions/libipt_icmp.c > > +++ b/extensions/libipt_icmp.c > > @@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type, > > } > > > > static void icmp_print(const void *ip, const struct xt_entry_match *match, > > - int numeric) > > + int numeric) > > { > > const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; > > > > @@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) > > } > > } > > > > +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, > > + unsigned int code_min, unsigned int code_max) > > +{ > > + unsigned int i; > > + > > + if (code_min == code_max) > > + return 0; > > + > > + switch (icmptype) { > > + case 0xFF: > > + case 9: > > + case 10: > > Why are we skipping these here? > These are types which doesn't seem to be supported by nftables: any, router-advertisement and router-solicitation, so in this case we would return a 0 in order to indicate that the translation is not supported. > > + return 0; > > + default: > > + for (i = 0; ARRAY_SIZE(icmp_codes); ++i) > > Missing bracket here. > > > + if (icmp_codes[i].type == icmptype && > > + icmp_codes[i].code_min == code_min && > > + icmp_codes[i].code_max == code_max) > > + break; > > + > > + xt_xlate_add(xl, icmp_codes[i].name); > > Same thing. But as I said in the previous patch, are you sure you need > this code snippet above at this stage? > The brackets are not missing here, sorry for the confusion. Inside the for statement we only have the condition. Just the xt_late_add function indentation is not correct. This code it's needed in order to translate from types numbers to type names, but we're ensuring after that which types names are similar in iptables and nftables. For example, with this code we get: $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn Without this code: $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG nft add rule ip filter INPUT icmp type 3 counter log level warn > > + } > > + > > + return 1; > > +} > > + > > +static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl, > > + int numeric) > > +{ > > + const struct ipt_icmp *info = (struct ipt_icmp *)match->data; > > + > > + xt_xlate_add(xl, "icmp type%s ", > > + (info->invflags & IPT_ICMP_INV) ? " !=" : ""); > > + > > + if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) > > + return 0; > > + > > + xt_xlate_add(xl, " "); > > + > > + return 1; > > +} > > + > > + > > static struct xtables_match icmp_mt_reg = { > > .name = "icmp", > > .version = XTABLES_VERSION, > > @@ -261,6 +304,7 @@ static struct xtables_match icmp_mt_reg = { > > .save = icmp_save, > > .x6_parse = icmp_parse, > > .x6_options = icmp_opts, > > + .xlate = icmp_xlate, > > }; > > > > void _init(void) > > -- > > 2.7.0 > > ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCHv2] extensions: libipt_icmp: Add translation to nft 2016-03-07 18:04 ` Laura Garcia @ 2016-03-07 18:10 ` Shivani Bhardwaj 2016-03-07 18:27 ` Pablo Neira Ayuso 2016-03-07 18:20 ` Pablo Neira Ayuso 1 sibling, 1 reply; 8+ messages in thread From: Shivani Bhardwaj @ 2016-03-07 18:10 UTC (permalink / raw) To: Laura Garcia Cc: Pablo Neira Ayuso, Netfilter Development Mailing list, outreachy-kernel On Mon, Mar 7, 2016 at 11:34 PM, Laura Garcia <nevola@gmail.com> wrote: > On Mon, Mar 07, 2016 at 06:14:08PM +0100, Pablo Neira Ayuso wrote: >> On Sun, Mar 06, 2016 at 11:24:44PM +0100, Laura Garcia Liebana wrote: >> > Add translation for icmp to nftables. Not supported types in nftables >> > are: any, network-unreachable, host-unreachable, protocol-unreachable, >> > port-unreachable, fragmentation-needed, source-route-failed, >> > network-unknown, host-unknown, network-prohibited, host-prohibited, >> > TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, >> > host-precedence-violation, precedence-cutoff, network-redirect, >> > host-redirect, TOS-network-redirect, TOS-host-redirect, >> > router-advertisement, router-solicitation, ttl-zero-during-transit, >> > ttl-zero-during-reassembly, ip-header-bad and required-option-missing. >> > >> > Examples: >> > >> > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG >> > nft add rule ip filter INPUT icmp type echo-reply counter log level warn >> > >> > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG >> > nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn >> > >> > $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG >> > nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn >> > >> > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> >> > --- >> > v2: >> > - Detection of not supported types in nftables, as Shivani suggested. >> > >> > extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- >> > 1 file changed, 45 insertions(+), 1 deletion(-) >> > >> > diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c >> > index 666e7da..89eb36e 100644 >> > --- a/extensions/libipt_icmp.c >> > +++ b/extensions/libipt_icmp.c >> > @@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type, >> > } >> > >> > static void icmp_print(const void *ip, const struct xt_entry_match *match, >> > - int numeric) >> > + int numeric) >> > { >> > const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; >> > >> > @@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) >> > } >> > } >> > >> > +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, >> > + unsigned int code_min, unsigned int code_max) >> > +{ >> > + unsigned int i; >> > + >> > + if (code_min == code_max) >> > + return 0; >> > + >> > + switch (icmptype) { >> > + case 0xFF: >> > + case 9: >> > + case 10: >> >> Why are we skipping these here? >> > > These are types which doesn't seem to be supported by nftables: any, > router-advertisement and router-solicitation, so in this case we would > return a 0 in order to indicate that the translation is not supported. > >> > + return 0; >> > + default: >> > + for (i = 0; ARRAY_SIZE(icmp_codes); ++i) >> >> Missing bracket here. >> >> > + if (icmp_codes[i].type == icmptype && >> > + icmp_codes[i].code_min == code_min && >> > + icmp_codes[i].code_max == code_max) >> > + break; >> > + >> > + xt_xlate_add(xl, icmp_codes[i].name); >> >> Same thing. But as I said in the previous patch, are you sure you need >> this code snippet above at this stage? >> > > The brackets are not missing here, sorry for the confusion. Inside the for > statement we only have the condition. Just the xt_late_add function indentation is not correct. > > This code it's needed in order to translate from types numbers to type > names, but we're ensuring after that which types names are similar in > iptables and nftables. For example, with this code we get: > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG > nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn > > Without this code: > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG > nft add rule ip filter INPUT icmp type 3 counter log level warn > This looks good too. nftables is anyway going to convert it to its name type (if available). See how this above rule shows up in the chain: table ip filter { chain INPUT { type filter hook input priority 0; policy accept; icmp type destination-unreachable counter packets 0 bytes 0 log } } But, anyway, wait for Pablo's comments about this. > >> > + } >> > + >> > + return 1; >> > +} >> > + >> > +static int icmp_xlate(const struct xt_entry_match *match, struct xt_xlate *xl, >> > + int numeric) >> > +{ >> > + const struct ipt_icmp *info = (struct ipt_icmp *)match->data; >> > + >> > + xt_xlate_add(xl, "icmp type%s ", >> > + (info->invflags & IPT_ICMP_INV) ? " !=" : ""); >> > + >> > + if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) >> > + return 0; >> > + >> > + xt_xlate_add(xl, " "); >> > + >> > + return 1; >> > +} >> > + >> > + >> > static struct xtables_match icmp_mt_reg = { >> > .name = "icmp", >> > .version = XTABLES_VERSION, >> > @@ -261,6 +304,7 @@ static struct xtables_match icmp_mt_reg = { >> > .save = icmp_save, >> > .x6_parse = icmp_parse, >> > .x6_options = icmp_opts, >> > + .xlate = icmp_xlate, >> > }; >> > >> > void _init(void) >> > -- >> > 2.7.0 >> > ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCHv2] extensions: libipt_icmp: Add translation to nft 2016-03-07 18:10 ` Shivani Bhardwaj @ 2016-03-07 18:27 ` Pablo Neira Ayuso 0 siblings, 0 replies; 8+ messages in thread From: Pablo Neira Ayuso @ 2016-03-07 18:27 UTC (permalink / raw) To: Shivani Bhardwaj Cc: Laura Garcia, Netfilter Development Mailing list, outreachy-kernel On Mon, Mar 07, 2016 at 11:40:08PM +0530, Shivani Bhardwaj wrote: > On Mon, Mar 7, 2016 at 11:34 PM, Laura Garcia <nevola@gmail.com> wrote: > > On Mon, Mar 07, 2016 at 06:14:08PM +0100, Pablo Neira Ayuso wrote: > >> On Sun, Mar 06, 2016 at 11:24:44PM +0100, Laura Garcia Liebana wrote: > > The brackets are not missing here, sorry for the confusion. Inside the for > > statement we only have the condition. Just the xt_late_add function indentation is not correct. > > > > This code it's needed in order to translate from types numbers to type > > names, but we're ensuring after that which types names are similar in > > iptables and nftables. For example, with this code we get: > > > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG > > nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn > > > > Without this code: > > > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG > > nft add rule ip filter INPUT icmp type 3 counter log level warn > > > This looks good too. nftables is anyway going to convert it to its > name type (if available). See how this above rule shows up in the > chain: > > table ip filter { > chain INPUT { > type filter hook input priority 0; policy accept; > icmp type destination-unreachable counter packets 0 bytes 0 log > } > } > > But, anyway, wait for Pablo's comments about this. Translation to text is better, if possible. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCHv2] extensions: libipt_icmp: Add translation to nft 2016-03-07 18:04 ` Laura Garcia 2016-03-07 18:10 ` Shivani Bhardwaj @ 2016-03-07 18:20 ` Pablo Neira Ayuso 2016-03-07 18:50 ` Laura Garcia 1 sibling, 1 reply; 8+ messages in thread From: Pablo Neira Ayuso @ 2016-03-07 18:20 UTC (permalink / raw) To: Laura Garcia; +Cc: netfilter-devel, shivanib134, outreachy-kernel On Mon, Mar 07, 2016 at 07:04:46PM +0100, Laura Garcia wrote: > On Mon, Mar 07, 2016 at 06:14:08PM +0100, Pablo Neira Ayuso wrote: > > On Sun, Mar 06, 2016 at 11:24:44PM +0100, Laura Garcia Liebana wrote: > > > Add translation for icmp to nftables. Not supported types in nftables > > > are: any, network-unreachable, host-unreachable, protocol-unreachable, > > > port-unreachable, fragmentation-needed, source-route-failed, > > > network-unknown, host-unknown, network-prohibited, host-prohibited, > > > TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, > > > host-precedence-violation, precedence-cutoff, network-redirect, > > > host-redirect, TOS-network-redirect, TOS-host-redirect, > > > router-advertisement, router-solicitation, ttl-zero-during-transit, > > > ttl-zero-during-reassembly, ip-header-bad and required-option-missing. > > > > > > Examples: > > > > > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j LOG > > > nft add rule ip filter INPUT icmp type echo-reply counter log level warn > > > > > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j LOG > > > nft add rule ip filter INPUT icmp type destination-unreachable counter log level warn > > > > > > $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG > > > nft add rule ip filter INPUT icmp type != destination-unreachable counter log level warn > > > > > > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> > > > --- > > > v2: > > > - Detection of not supported types in nftables, as Shivani suggested. > > > > > > extensions/libipt_icmp.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- > > > 1 file changed, 45 insertions(+), 1 deletion(-) > > > > > > diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c > > > index 666e7da..89eb36e 100644 > > > --- a/extensions/libipt_icmp.c > > > +++ b/extensions/libipt_icmp.c > > > @@ -218,7 +218,7 @@ static void print_icmptype(uint8_t type, > > > } > > > > > > static void icmp_print(const void *ip, const struct xt_entry_match *match, > > > - int numeric) > > > + int numeric) > > > { > > > const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; > > > > > > @@ -249,6 +249,49 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) > > > } > > > } > > > > > > +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, > > > + unsigned int code_min, unsigned int code_max) > > > +{ > > > + unsigned int i; > > > + > > > + if (code_min == code_max) > > > + return 0; > > > + > > > + switch (icmptype) { > > > + case 0xFF: > > > + case 9: > > > + case 10: > > > > Why are we skipping these here? > > > > These are types which doesn't seem to be supported by nftables: any, > router-advertisement and router-solicitation, so in this case we would > return a 0 in order to indicate that the translation is not supported. I think you can add these two to icmp_type_tbl in nft/src/proto.c, it would be just a two-liner to support ICMP_ROUTERADVERT and ICMP_ROUTERSOLICIT. Regarding 'any', you can just skip translating this. From ip_tables kernel code I can see this just return true in case 0xff is specified. so the right translation to me is not to print anything. > > > + return 0; > > > + default: > > > + for (i = 0; ARRAY_SIZE(icmp_codes); ++i) > > > > Missing bracket here. > > > > > + if (icmp_codes[i].type == icmptype && > > > + icmp_codes[i].code_min == code_min && > > > + icmp_codes[i].code_max == code_max) > > > + break; > > > + > > > + xt_xlate_add(xl, icmp_codes[i].name); > > > > Same thing. But as I said in the previous patch, are you sure you need > > this code snippet above at this stage? > > > > The brackets are not missing here, sorry for the confusion. Inside the for > statement we only have the condition. Just the xt_late_add function indentation is not correct. OK, makes sense. Then fix this broken indent and resubmit a v2, thanks Laura. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCHv2] extensions: libipt_icmp: Add translation to nft 2016-03-07 18:20 ` Pablo Neira Ayuso @ 2016-03-07 18:50 ` Laura Garcia 0 siblings, 0 replies; 8+ messages in thread From: Laura Garcia @ 2016-03-07 18:50 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel, shivanib134, outreachy-kernel On Mon, Mar 07, 2016 at 07:20:54PM +0100, Pablo Neira Ayuso wrote: > > I think you can add these two to icmp_type_tbl in nft/src/proto.c, it > would be just a two-liner to support ICMP_ROUTERADVERT and > ICMP_ROUTERSOLICIT. > Ok, thanks! ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2016-03-07 18:50 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-03-06 22:24 [PATCHv2] extensions: libipt_icmp: Add translation to nft Laura Garcia Liebana 2016-03-07 16:58 ` Pablo Neira Ayuso 2016-03-07 17:14 ` Pablo Neira Ayuso 2016-03-07 18:04 ` Laura Garcia 2016-03-07 18:10 ` Shivani Bhardwaj 2016-03-07 18:27 ` Pablo Neira Ayuso 2016-03-07 18:20 ` Pablo Neira Ayuso 2016-03-07 18:50 ` Laura Garcia
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).