diff options
| -rw-r--r-- | extensions/libebt_ip.c | 4 | ||||
| -rw-r--r-- | extensions/libebt_ip.txlate | 18 | ||||
| -rw-r--r-- | extensions/libebt_ip6.c | 2 | ||||
| -rw-r--r-- | extensions/libebt_ip6.txlate | 20 | ||||
| -rw-r--r-- | extensions/libebt_vlan.txlate | 8 | ||||
| -rw-r--r-- | iptables/nft-bridge.c | 23 |
6 files changed, 46 insertions, 29 deletions
diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c index 9b3cd33c..4b5c1665 100644 --- a/extensions/libebt_ip.c +++ b/extensions/libebt_ip.c @@ -686,9 +686,9 @@ static int brip_xlate(struct xt_xlate *xl, if (info->bitmask & EBT_IP_PROTO) { struct protoent *pe; - if (info->bitmask & (EBT_IP_SPORT|EBT_IP_DPORT) && + if (info->bitmask & (EBT_IP_SPORT|EBT_IP_DPORT|EBT_IP_ICMP) && (info->invflags & EBT_IP_PROTO) == 0) { - /* port number given and not inverted, no need to print this */ + /* port number or icmp given and not inverted, no need to print this */ pname = brip_xlate_proto_to_name(info->protocol); } else { xt_xlate_add(xl, "ip protocol "); diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate index cbe05f4f..b5882c34 100644 --- a/extensions/libebt_ip.txlate +++ b/extensions/libebt_ip.txlate @@ -1,26 +1,26 @@ -ebtables-translate -A FORWARD --ip-src ! 192.168.0.0/24 -j ACCEPT +ebtables-translate -A FORWARD -p ip --ip-src ! 192.168.0.0/24 -j ACCEPT nft add rule bridge filter FORWARD ip saddr != 192.168.0.0/24 counter accept -ebtables-translate -I FORWARD --ip-dst 10.0.0.1 +ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 nft insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter -ebtables-translate -I OUTPUT 3 -o eth0 --ip-tos 0xff +ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff nft insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter -ebtables-translate -A FORWARD --ip-proto tcp --ip-dport 22 +ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 nft add rule bridge filter FORWARD tcp dport 22 counter -ebtables-translate -A FORWARD --ip-proto udp --ip-sport 1024:65535 +ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 nft add rule bridge filter FORWARD udp sport 1024-65535 counter -ebtables-translate -A FORWARD --ip-proto 253 +ebtables-translate -A FORWARD -p ip --ip-proto 253 nft add rule bridge filter FORWARD ip protocol 253 counter -ebtables-translate -A FORWARD --ip-icmp-type "echo-request" +ebtables-translate -A FORWARD -p ip --ip-protocol icmp --ip-icmp-type "echo-request" nft add rule bridge filter FORWARD icmp type 8 counter -ebtables-translate -A FORWARD --ip-icmp-type 1/1 +ebtables-translate -A FORWARD -p ip --ip-proto icmp --ip-icmp-type 1/1 nft add rule bridge filter FORWARD icmp type 1 icmp code 1 counter -ebtables-translate -A FORWARD --ip-icmp-type ! 1:10 +ebtables-translate -A FORWARD -p ip --ip-protocol icmp --ip-icmp-type ! 1:10 nft add rule bridge filter FORWARD icmp type != 1-10 counter diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c index f1ebb8b9..4c60570e 100644 --- a/extensions/libebt_ip6.c +++ b/extensions/libebt_ip6.c @@ -564,7 +564,7 @@ static int brip6_xlate(struct xt_xlate *xl, if (info->bitmask & EBT_IP6_PROTO) { struct protoent *pe; - if (info->bitmask & (EBT_IP6_SPORT|EBT_IP6_DPORT) && + if (info->bitmask & (EBT_IP6_SPORT|EBT_IP6_DPORT|EBT_IP6_ICMP6) && (info->invflags & EBT_IP6_PROTO) == 0) { /* port number given and not inverted, no need to * add explicit 'meta l4proto'. diff --git a/extensions/libebt_ip6.txlate b/extensions/libebt_ip6.txlate index 0f2efdf8..0271734c 100644 --- a/extensions/libebt_ip6.txlate +++ b/extensions/libebt_ip6.txlate @@ -1,29 +1,29 @@ -ebtables-translate -A FORWARD --ip6-src ! dead::beef/64 -j ACCEPT +ebtables-translate -A FORWARD -p ip6 --ip6-src ! dead::beef/64 -j ACCEPT nft add rule bridge filter FORWARD ip6 saddr != dead::/64 counter accept -ebtables-translate -A FORWARD ! --ip6-dst dead:beef::/64 -j ACCEPT +ebtables-translate -A FORWARD -p ip6 ! --ip6-dst dead:beef::/64 -j ACCEPT nft add rule bridge filter FORWARD ip6 daddr != dead:beef::/64 counter accept -ebtables-translate -I FORWARD --ip6-dst f00:ba:: +ebtables-translate -I FORWARD -p ip6 --ip6-dst f00:ba:: nft insert rule bridge filter FORWARD ip6 daddr f00:ba:: counter -ebtables-translate -I OUTPUT -o eth0 --ip6-tclass 0xff +ebtables-translate -I OUTPUT -o eth0 -p ip6 --ip6-tclass 0xff nft insert rule bridge filter OUTPUT oifname "eth0" ip6 dscp 0x3f counter -ebtables-translate -A FORWARD --ip6-proto tcp --ip6-dport 22 +ebtables-translate -A FORWARD -p ip6 --ip6-proto tcp --ip6-dport 22 nft add rule bridge filter FORWARD ether type ip6 tcp dport 22 counter -ebtables-translate -A FORWARD --ip6-proto udp --ip6-sport 1024:65535 +ebtables-translate -A FORWARD -p ip6 --ip6-proto udp --ip6-sport 1024:65535 nft add rule bridge filter FORWARD ether type ip6 udp sport 1024-65535 counter -ebtables-translate -A FORWARD --ip6-proto 253 +ebtables-translate -A FORWARD -p ip6 --ip6-proto 253 nft add rule bridge filter FORWARD ether type ip6 meta l4proto 253 counter -ebtables-translate -A FORWARD --ip6-icmp-type "echo-request" +ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type "echo-request" nft add rule bridge filter FORWARD icmpv6 type 128 counter -ebtables-translate -A FORWARD --ip6-icmp-type 1/1 +ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type 1/1 nft add rule bridge filter FORWARD icmpv6 type 1 icmpv6 code 1 counter -ebtables-translate -A FORWARD --ip6-icmp-type ! 1:10 +ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type ! 1:10 nft add rule bridge filter FORWARD icmpv6 type != 1-10 counter diff --git a/extensions/libebt_vlan.txlate b/extensions/libebt_vlan.txlate index fe1ec141..2ab62d53 100644 --- a/extensions/libebt_vlan.txlate +++ b/extensions/libebt_vlan.txlate @@ -1,11 +1,11 @@ -ebtables-translate -A INPUT --vlan-id 42 +ebtables-translate -A INPUT -p 802_1Q --vlan-id 42 nft add rule bridge filter INPUT vlan id 42 counter -ebtables-translate -A INPUT --vlan-prio ! 1 +ebtables-translate -A INPUT -p 802_1Q --vlan-prio ! 1 nft add rule bridge filter INPUT vlan pcp != 1 counter -ebtables-translate -A INPUT --vlan-encap ip +ebtables-translate -A INPUT -p 802_1Q --vlan-encap ip nft add rule bridge filter INPUT vlan type 0x0800 counter -ebtables-translate -A INPUT --vlan-encap ipv6 ! --vlan-id 1 +ebtables-translate -A INPUT -p 802_1Q --vlan-encap ipv6 ! --vlan-id 1 nft add rule bridge filter INPUT vlan id != 1 vlan type 0x86dd counter diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index bf8949a5..fb19fea3 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -650,9 +650,26 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl) cs->eb.invflags & EBT_ILOGICALOUT); if ((cs->eb.bitmask & EBT_NOPROTO) == 0) { - xt_xlate_add(xl, "ether type %s 0x%x ", - cs->eb.invflags & EBT_IPROTO ? "!= " : "", - ntohs(cs->eb.ethproto)); + const char *implicit = NULL; + + switch (ntohs(cs->eb.ethproto)) { + case ETH_P_IP: + implicit = "ip"; + break; + case ETH_P_IPV6: + implicit = "ip6"; + break; + case ETH_P_8021Q: + implicit = "vlan"; + break; + default: + break; + } + + if (!implicit || !xlate_find_match(cs, implicit)) + xt_xlate_add(xl, "ether type %s 0x%x ", + cs->eb.invflags & EBT_IPROTO ? "!= " : "", + ntohs(cs->eb.ethproto)); } if (cs->eb.bitmask & EBT_802_3) |