summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--extensions/libip6t_mh.txlate6
-rw-r--r--iptables/nft-ipv4.c23
-rw-r--r--iptables/nft-ipv6.c23
-rw-r--r--iptables/nft.h1
-rw-r--r--iptables/xtables-translate.c17
5 files changed, 42 insertions, 28 deletions
diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate
index 3364ce57..cc194254 100644
--- a/extensions/libip6t_mh.txlate
+++ b/extensions/libip6t_mh.txlate
@@ -1,8 +1,8 @@
ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT
-nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter accept'
+nft 'add rule ip6 filter INPUT mh type 1 counter accept'
ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT
-nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept'
+nft 'add rule ip6 filter INPUT mh type 1-3 counter accept'
ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT
nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept'
@@ -11,4 +11,4 @@ ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT
nft 'add rule ip6 filter INPUT exthdr mh exists counter accept'
ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT
-nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept'
+nft 'add rule ip6 filter INPUT mh type != 0-255 counter accept'
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 0ce8477f..74092875 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -200,6 +200,7 @@ static void xlate_ipv4_addr(const char *selector, const struct in_addr *addr,
static int nft_ipv4_xlate(const struct iptables_command_state *cs,
struct xt_xlate *xl)
{
+ uint16_t proto = cs->fw.ip.proto;
const char *comment;
int ret;
@@ -213,18 +214,16 @@ static int nft_ipv4_xlate(const struct iptables_command_state *cs,
cs->fw.ip.invflags & IPT_INV_FRAG? "" : "!= ", 0);
}
- if (cs->fw.ip.proto != 0) {
- const char *pname = proto_to_name(cs->fw.ip.proto, 0);
-
- if (!pname || !xlate_find_match(cs, pname)) {
- xt_xlate_add(xl, "ip protocol");
- if (cs->fw.ip.invflags & IPT_INV_PROTO)
- xt_xlate_add(xl, " !=");
- if (pname)
- xt_xlate_add(xl, "%s", pname);
- else
- xt_xlate_add(xl, "%hu", cs->fw.ip.proto);
- }
+ if (proto != 0 && !xlate_find_protomatch(cs, proto)) {
+ const char *pname = proto_to_name(proto, 0);
+
+ xt_xlate_add(xl, "ip protocol");
+ if (cs->fw.ip.invflags & IPT_INV_PROTO)
+ xt_xlate_add(xl, " !=");
+ if (pname)
+ xt_xlate_add(xl, "%s", pname);
+ else
+ xt_xlate_add(xl, "%hu", proto);
}
xlate_ipv4_addr("ip saddr", &cs->fw.ip.src, &cs->fw.ip.smsk,
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index c371ba8c..b184f8af 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -184,6 +184,7 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr,
static int nft_ipv6_xlate(const struct iptables_command_state *cs,
struct xt_xlate *xl)
{
+ uint16_t proto = cs->fw6.ipv6.proto;
const char *comment;
int ret;
@@ -192,18 +193,16 @@ static int nft_ipv6_xlate(const struct iptables_command_state *cs,
xlate_ifname(xl, "oifname", cs->fw6.ipv6.outiface,
cs->fw6.ipv6.invflags & IP6T_INV_VIA_OUT);
- if (cs->fw6.ipv6.proto != 0) {
- const char *pname = proto_to_name(cs->fw6.ipv6.proto, 0);
-
- if (!pname || !xlate_find_match(cs, pname)) {
- xt_xlate_add(xl, "meta l4proto");
- if (cs->fw6.ipv6.invflags & IP6T_INV_PROTO)
- xt_xlate_add(xl, " !=");
- if (pname)
- xt_xlate_add(xl, "%s", pname);
- else
- xt_xlate_add(xl, "%hu", cs->fw6.ipv6.proto);
- }
+ if (proto != 0 && !xlate_find_protomatch(cs, proto)) {
+ const char *pname = proto_to_name(proto, 0);
+
+ xt_xlate_add(xl, "meta l4proto");
+ if (cs->fw6.ipv6.invflags & IP6T_INV_PROTO)
+ xt_xlate_add(xl, " !=");
+ if (pname)
+ xt_xlate_add(xl, "%s", pname);
+ else
+ xt_xlate_add(xl, "%hu", proto);
}
xlate_ipv6_addr("ip6 saddr", &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
diff --git a/iptables/nft.h b/iptables/nft.h
index 57533b65..b2a8484f 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -242,6 +242,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, boo
struct xt_buf;
bool xlate_find_match(const struct iptables_command_state *cs, const char *p_name);
+bool xlate_find_protomatch(const struct iptables_command_state *cs, uint16_t proto);
int xlate_matches(const struct iptables_command_state *cs, struct xt_xlate *xl);
int xlate_action(const struct iptables_command_state *cs, bool goto_set,
struct xt_xlate *xl);
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 8ebe523c..3d8617f0 100644
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -131,7 +131,6 @@ bool xlate_find_match(const struct iptables_command_state *cs, const char *p_nam
{
struct xtables_rule_match *matchp;
- /* Skip redundant protocol, eg. ip protocol tcp tcp dport */
for (matchp = cs->matches; matchp; matchp = matchp->next) {
if (strcmp(matchp->match->name, p_name) == 0)
return true;
@@ -139,6 +138,22 @@ bool xlate_find_match(const struct iptables_command_state *cs, const char *p_nam
return false;
}
+bool xlate_find_protomatch(const struct iptables_command_state *cs,
+ uint16_t proto)
+{
+ struct protoent *pent;
+ int i;
+
+ /* Skip redundant protocol, eg. ip protocol tcp tcp dport */
+ for (i = 0; xtables_chain_protos[i].name != NULL; i++) {
+ if (xtables_chain_protos[i].num == proto &&
+ xlate_find_match(cs, xtables_chain_protos[i].name))
+ return true;
+ }
+ pent = getprotobynumber(proto);
+ return pent && xlate_find_match(cs, pent->p_name);
+}
+
const char *family2str[] = {
[NFPROTO_ARP] = "arp",
[NFPROTO_IPV4] = "ip",