On Thu, Jan 14, 2016 at 11:10:09PM +0530, Shivani Bhardwaj wrote: > Add translation for mobility header to nftables. > > Examples: > > $ sudo ip6tables-translate -A INPUT -p mh -j ACCEPT > nft add rule ip6 filter INPUT ip6 nexthdr mobility-header counter accept > > $ sudo ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT > nft add rule ip6 filter INPUT ip6 nexthdr mobility-header mh type 1 counter accept > > $ sudo ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT > nft add rule ip6 filter INPUT ip6 nexthdr mobility-header mh type 1-3 counter accept I think this translation will not work as the mobility header may not be exactly the next header, in IPv6 you can get several extension headers one after another. By now I'd suggest: ... meta l4proto mobility-header mh type 1 counter Anyway, the extension header expression needs some care, it would be good to keep this documented in the wiki page. While at this, it would be good if you can verify that our definition in nftables matches rfc6275 (see nftables/src/exthdr.c), I already detected wrong header definitions in the past. It would be also good if you can go back to all your translations and validate what we already got into the tree from the packet path, ie. generate traffic that matches the rule in ip6tables and nftables. Note sure if you made this checks. Some of them should be easy to test, some other may take a while, python scapy may help in some cases to forge and to inject a packet with a specific layout. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
