From 46c5245244f517341786145048b9276600f10e4b Mon Sep 17 00:00:00 2001 From: Laura Garcia Liebana Date: Thu, 2 Jun 2016 00:08:08 +0200 Subject: extensions: libip6t_hbh: Add translation to nft Add translation for Hop-By-Hop header to nftables. Hbh options are not supported yet in nft. $ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22 nft add rule ip6 filter INPUT hbh hdrlength 22 counter $ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22 nft add rule ip6 filter INPUT hbh hdrlength != 22 counter Signed-off-by: Laura Garcia Liebana Signed-off-by: Pablo Neira Ayuso --- extensions/libip6t_hbh.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c index c0389ed8..416681d2 100644 --- a/extensions/libip6t_hbh.c +++ b/extensions/libip6t_hbh.c @@ -164,6 +164,22 @@ static void hbh_save(const void *ip, const struct xt_entry_match *match) print_options(optinfo->optsnr, (uint16_t *)optinfo->opts); } +static int hbh_xlate(const void *ip, const struct xt_entry_match *match, + struct xt_xlate *xl, int numeric) +{ + const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; + + if (!(optinfo->flags & IP6T_OPTS_LEN) || + (optinfo->flags & IP6T_OPTS_OPTS)) + return 0; + + xt_xlate_add(xl, "hbh hdrlength %s%u ", + (optinfo->invflags & IP6T_OPTS_INV_LEN) ? "!= " : "", + optinfo->hdrlen); + + return 1; +} + static struct xtables_match hbh_mt6_reg = { .name = "hbh", .version = XTABLES_VERSION, @@ -175,6 +191,7 @@ static struct xtables_match hbh_mt6_reg = { .save = hbh_save, .x6_parse = hbh_parse, .x6_options = hbh_opts, + .xlate = hbh_xlate, }; void -- cgit v1.2.3