From 6454d7dc89f83920cd08606fdff43358c7e64a53 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 8 May 2018 10:15:11 +0200 Subject: ebtables-translate: suppress redundant protocols kernel would reject ip, ip6 etc. without -p ip, -p ip6. So add it. On reverse, search the match list to decide if -p has to be translated or not. Also, icmp and icmpv6 also imply l3 protocol, so no need to translate that either. Signed-off-by: Florian Westphal --- extensions/libebt_ip6.txlate | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'extensions/libebt_ip6.txlate') diff --git a/extensions/libebt_ip6.txlate b/extensions/libebt_ip6.txlate index 0f2efdf8..0271734c 100644 --- a/extensions/libebt_ip6.txlate +++ b/extensions/libebt_ip6.txlate @@ -1,29 +1,29 @@ -ebtables-translate -A FORWARD --ip6-src ! dead::beef/64 -j ACCEPT +ebtables-translate -A FORWARD -p ip6 --ip6-src ! dead::beef/64 -j ACCEPT nft add rule bridge filter FORWARD ip6 saddr != dead::/64 counter accept -ebtables-translate -A FORWARD ! --ip6-dst dead:beef::/64 -j ACCEPT +ebtables-translate -A FORWARD -p ip6 ! --ip6-dst dead:beef::/64 -j ACCEPT nft add rule bridge filter FORWARD ip6 daddr != dead:beef::/64 counter accept -ebtables-translate -I FORWARD --ip6-dst f00:ba:: +ebtables-translate -I FORWARD -p ip6 --ip6-dst f00:ba:: nft insert rule bridge filter FORWARD ip6 daddr f00:ba:: counter -ebtables-translate -I OUTPUT -o eth0 --ip6-tclass 0xff +ebtables-translate -I OUTPUT -o eth0 -p ip6 --ip6-tclass 0xff nft insert rule bridge filter OUTPUT oifname "eth0" ip6 dscp 0x3f counter -ebtables-translate -A FORWARD --ip6-proto tcp --ip6-dport 22 +ebtables-translate -A FORWARD -p ip6 --ip6-proto tcp --ip6-dport 22 nft add rule bridge filter FORWARD ether type ip6 tcp dport 22 counter -ebtables-translate -A FORWARD --ip6-proto udp --ip6-sport 1024:65535 +ebtables-translate -A FORWARD -p ip6 --ip6-proto udp --ip6-sport 1024:65535 nft add rule bridge filter FORWARD ether type ip6 udp sport 1024-65535 counter -ebtables-translate -A FORWARD --ip6-proto 253 +ebtables-translate -A FORWARD -p ip6 --ip6-proto 253 nft add rule bridge filter FORWARD ether type ip6 meta l4proto 253 counter -ebtables-translate -A FORWARD --ip6-icmp-type "echo-request" +ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type "echo-request" nft add rule bridge filter FORWARD icmpv6 type 128 counter -ebtables-translate -A FORWARD --ip6-icmp-type 1/1 +ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type 1/1 nft add rule bridge filter FORWARD icmpv6 type 1 icmpv6 code 1 counter -ebtables-translate -A FORWARD --ip6-icmp-type ! 1:10 +ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type ! 1:10 nft add rule bridge filter FORWARD icmpv6 type != 1-10 counter -- cgit v1.2.3