diff options
| author | Laura Garcia Liebana <nevola@gmail.com> | 2016-06-02 00:08:08 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-06-02 13:07:33 +0200 |
| commit | 46c5245244f517341786145048b9276600f10e4b (patch) | |
| tree | 98a02cc0a1c64c60ed361c799de16cd46df94e15 /extensions/libip6t_hbh.c | |
| parent | 2bd49c03c8601aff8f951a8153e95bfdeb7b84d8 (diff) | |
extensions: libip6t_hbh: Add translation to nft
Add translation for Hop-By-Hop header to nftables. Hbh options are not
supported yet in nft.
$ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength 22 counter
$ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22
nft add rule ip6 filter INPUT hbh hdrlength != 22 counter
Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libip6t_hbh.c')
| -rw-r--r-- | extensions/libip6t_hbh.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c index c0389ed8..416681d2 100644 --- a/extensions/libip6t_hbh.c +++ b/extensions/libip6t_hbh.c @@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match) print_options(optinfo->optsnr, (uint16_t *)optinfo->opts); } +static int hbh_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; + + if (!(optinfo->flags & IP6T_OPTS_LEN) || + (optinfo->flags & IP6T_OPTS_OPTS)) + return 0; + + xt_xlate_add(xl, "hbh hdrlength %s%u ", + (optinfo->invflags & IP6T_OPTS_INV_LEN) ? "!= " : "", + optinfo->hdrlen); + + return 1; +} + static struct xtables_match hbh_mt6_reg = { .name = "hbh", .version = XTABLES_VERSION, @@ -175,6 +191,7 @@ static struct xtables_match hbh_mt6_reg = { .save = hbh_save, .x6_parse = hbh_parse, .x6_options = hbh_opts, + .xlate = hbh_xlate, }; void |