diff options
author | Laura Garcia Liebana <nevola@gmail.com> | 2016-03-07 22:22:55 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-03-08 11:47:00 +0100 |
commit | fcc183744956780cb88dca4d242b9a0f243434e4 (patch) | |
tree | 94610c8e28243b61bd58482d7104d6c1662777f1 | |
parent | 9dbb616c2f0c3f7f452acc502e3b623d1b8c36b8 (diff) |
extensions: libip6t_icmp6: Add translation to nft
Add translation for icmpv6 to nftables.
Not supported icmp codes in nftables are: no-route,
communication-prohibited, beyond-scope, address-unreachable,
port-unreachable, failed-policy, reject-route, ttl-zero-during-transit,
ttl-zero-during-reassembly, bad-header, unknown-header-type and
unknown-option.
Examples:
$ ip6tables-translate -t filter -A INPUT -m icmp6 --icmpv6-type 1 -j LOG
nft add rule ip6 filter INPUT icmpv6 type destination-unreachable counter log level warn
$ ip6tables-translate -t filter -A INPUT -m icmp6 --icmpv6-type neighbour-advertisement -j LOG
nft add rule ip6 filter INPUT icmpv6 type nd-neighbor-advert counter log level warn
$ ip6tables-translate -t filter -A INPUT -m icmp6 ! --icmpv6-type packet-too-big -j LOG
nft add rule ip6 filter INPUT icmpv6 type != packet-too-big counter log level warn
Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r-- | extensions/libip6t_icmp6.c | 66 |
1 files changed, 66 insertions, 0 deletions
diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c index e183ce6b..2c5aadd0 100644 --- a/extensions/libip6t_icmp6.c +++ b/extensions/libip6t_icmp6.c @@ -4,6 +4,7 @@ #include <xtables.h> #include <limits.h> /* INT_MAX in ip6_tables.h */ #include <linux/netfilter_ipv6/ip6_tables.h> +#include <netinet/icmp6.h> enum { O_ICMPV6_TYPE = 0, @@ -222,6 +223,70 @@ static void icmp6_save(const void *ip, const struct xt_entry_match *match) printf("/%u", icmpv6->code[0]); } +#define XT_ICMPV6_TYPE(type) (type - ND_ROUTER_SOLICIT) + +static const char *icmp6_type_xlate_array[] = { + [XT_ICMPV6_TYPE(ND_ROUTER_SOLICIT)] = "nd-router-solicit", + [XT_ICMPV6_TYPE(ND_ROUTER_ADVERT)] = "nd-router-advert", + [XT_ICMPV6_TYPE(ND_NEIGHBOR_SOLICIT)] = "nd-neighbor-solicit", + [XT_ICMPV6_TYPE(ND_NEIGHBOR_ADVERT)] = "nd-neighbor-advert", + [XT_ICMPV6_TYPE(ND_REDIRECT)] = "nd-redirect", +}; + +static const char *icmp6_type_xlate(unsigned int type) +{ + if (type < ND_ROUTER_SOLICIT || type > ND_REDIRECT) + return NULL; + + return icmp6_type_xlate_array[XT_ICMPV6_TYPE(type)]; +} + +static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, + unsigned int code_min, + unsigned int code_max) +{ + unsigned int i; + const char *type_name; + + if (code_min == code_max) + return 0; + + type_name = icmp6_type_xlate(icmptype); + + if (type_name) { + xt_xlate_add(xl, type_name); + } else { + for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) + if (icmpv6_codes[i].type == icmptype && + icmpv6_codes[i].code_min == code_min && + icmpv6_codes[i].code_max == code_max) + break; + + if (i != ARRAY_SIZE(icmpv6_codes)) + xt_xlate_add(xl, icmpv6_codes[i].name); + else + return 0; + } + + return 1; +} + +static int icmp6_xlate(const struct xt_entry_match *match, struct xt_xlate *xl, + int numeric) +{ + const struct ip6t_icmp *info = (struct ip6t_icmp *)match->data; + + xt_xlate_add(xl, "icmpv6 type%s ", + (info->invflags & IP6T_ICMP_INV) ? " !=" : ""); + + if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) + return 0; + + xt_xlate_add(xl, " "); + + return 1; +} + static struct xtables_match icmp6_mt6_reg = { .name = "icmp6", .version = XTABLES_VERSION, @@ -234,6 +299,7 @@ static struct xtables_match icmp6_mt6_reg = { .save = icmp6_save, .x6_parse = icmp6_parse, .x6_options = icmp6_opts, + .xlate = icmp6_xlate, }; void _init(void) |