ebtables-translate: suppress redundant protocols

kernel would reject ip, ip6 etc. without -p ip, -p ip6.
So add it.  On reverse, search the match list to decide if -p
has to be translated or not.

Also, icmp and icmpv6 also imply l3 protocol, so no need to translate
that either.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c
index 9b3cd33c28108894093923ce0e8445de5a603592..4b5c1665fc014c4d6bf49c397ba920883ed98ecd 100644 (file)
--- a/extensions/libebt_ip.c
+++ b/extensions/libebt_ip.c
@@ -686,9 +686,9 @@ static int brip_xlate(struct xt_xlate *xl,
        if (info->bitmask & EBT_IP_PROTO) {
                struct protoent *pe;
 
-               if (info->bitmask & (EBT_IP_SPORT|EBT_IP_DPORT) &&
+               if (info->bitmask & (EBT_IP_SPORT|EBT_IP_DPORT|EBT_IP_ICMP) &&
                    (info->invflags & EBT_IP_PROTO) == 0) {
-                       /* port number given and not inverted, no need to print this */
+                       /* port number or icmp given and not inverted, no need to print this */
                        pname = brip_xlate_proto_to_name(info->protocol);
                } else {
                        xt_xlate_add(xl, "ip protocol ");

diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate
index cbe05f4f11ffc30ccf7d7696bba91f79034f45e9..b5882c342b0473af77ebeb21a1d0accd392c3bd3 100644 (file)
--- a/extensions/libebt_ip.txlate
+++ b/extensions/libebt_ip.txlate
@@ -1,26 +1,26 @@
-ebtables-translate -A FORWARD --ip-src ! 192.168.0.0/24 -j ACCEPT
+ebtables-translate -A FORWARD -p ip --ip-src ! 192.168.0.0/24 -j ACCEPT
 nft add rule bridge filter FORWARD ip saddr != 192.168.0.0/24 counter accept
 
-ebtables-translate -I FORWARD --ip-dst 10.0.0.1
+ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1
 nft insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter
 
-ebtables-translate -I OUTPUT 3 -o eth0 --ip-tos 0xff
+ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff
 nft insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter
 
-ebtables-translate -A FORWARD --ip-proto tcp --ip-dport 22
+ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22
 nft add rule bridge filter FORWARD tcp dport 22 counter
 
-ebtables-translate -A FORWARD --ip-proto udp --ip-sport 1024:65535
+ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535
 nft add rule bridge filter FORWARD udp sport 1024-65535 counter
 
-ebtables-translate -A FORWARD --ip-proto 253
+ebtables-translate -A FORWARD -p ip --ip-proto 253
 nft add rule bridge filter FORWARD ip protocol 253 counter
 
-ebtables-translate -A FORWARD --ip-icmp-type "echo-request"
+ebtables-translate -A FORWARD -p ip --ip-protocol icmp --ip-icmp-type "echo-request"
 nft add rule bridge filter FORWARD icmp type 8 counter
 
-ebtables-translate -A FORWARD --ip-icmp-type 1/1
+ebtables-translate -A FORWARD -p ip --ip-proto icmp --ip-icmp-type 1/1
 nft add rule bridge filter FORWARD icmp type 1 icmp code 1 counter
 
-ebtables-translate -A FORWARD --ip-icmp-type ! 1:10
+ebtables-translate -A FORWARD -p ip --ip-protocol icmp --ip-icmp-type ! 1:10
 nft add rule bridge filter FORWARD icmp type != 1-10 counter

diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c
index f1ebb8b9652d9f17e191568401e95226ab547285..4c60570eaab73fd40ea7717dc23cf7e60114abff 100644 (file)
--- a/extensions/libebt_ip6.c
+++ b/extensions/libebt_ip6.c
@@ -564,7 +564,7 @@ static int brip6_xlate(struct xt_xlate *xl,
        if (info->bitmask & EBT_IP6_PROTO) {
                struct protoent *pe;
 
-               if (info->bitmask & (EBT_IP6_SPORT|EBT_IP6_DPORT) &&
+               if (info->bitmask & (EBT_IP6_SPORT|EBT_IP6_DPORT|EBT_IP6_ICMP6) &&
                    (info->invflags & EBT_IP6_PROTO) == 0) {
                        /* port number given and not inverted, no need to
                         * add explicit 'meta l4proto'.

diff --git a/extensions/libebt_ip6.txlate b/extensions/libebt_ip6.txlate
index 0f2efdf8fc07d56f6e07d8e4f92c7d0de82b3ca0..0271734c9b0991ced2b705d9e86fa09dd8993657 100644 (file)
--- a/extensions/libebt_ip6.txlate
+++ b/extensions/libebt_ip6.txlate
@@ -1,29 +1,29 @@
-ebtables-translate -A FORWARD --ip6-src ! dead::beef/64 -j ACCEPT
+ebtables-translate -A FORWARD -p ip6 --ip6-src ! dead::beef/64 -j ACCEPT
 nft add rule bridge filter FORWARD ip6 saddr != dead::/64 counter accept
 
-ebtables-translate -A FORWARD ! --ip6-dst dead:beef::/64 -j ACCEPT
+ebtables-translate -A FORWARD -p ip6 ! --ip6-dst dead:beef::/64 -j ACCEPT
 nft add rule bridge filter FORWARD ip6 daddr != dead:beef::/64 counter accept
 
-ebtables-translate -I FORWARD --ip6-dst f00:ba::
+ebtables-translate -I FORWARD -p ip6 --ip6-dst f00:ba::
 nft insert rule bridge filter FORWARD ip6 daddr f00:ba:: counter
 
-ebtables-translate -I OUTPUT -o eth0 --ip6-tclass 0xff
+ebtables-translate -I OUTPUT -o eth0 -p ip6 --ip6-tclass 0xff
 nft insert rule bridge filter OUTPUT oifname "eth0" ip6 dscp 0x3f counter
 
-ebtables-translate -A FORWARD --ip6-proto tcp --ip6-dport 22
+ebtables-translate -A FORWARD -p ip6 --ip6-proto tcp --ip6-dport 22
 nft add rule bridge filter FORWARD ether type ip6 tcp dport 22 counter
 
-ebtables-translate -A FORWARD --ip6-proto udp --ip6-sport 1024:65535
+ebtables-translate -A FORWARD -p ip6 --ip6-proto udp --ip6-sport 1024:65535
 nft add rule bridge filter FORWARD ether type ip6 udp sport 1024-65535 counter
 
-ebtables-translate -A FORWARD --ip6-proto 253
+ebtables-translate -A FORWARD -p ip6 --ip6-proto 253
 nft add rule bridge filter FORWARD ether type ip6 meta l4proto 253 counter
 
-ebtables-translate -A FORWARD --ip6-icmp-type "echo-request"
+ebtables-translate -A FORWARD -p ip6  --ip6-protocol icmpv6 --ip6-icmp-type "echo-request"
 nft add rule bridge filter FORWARD icmpv6 type 128 counter
 
-ebtables-translate -A FORWARD --ip6-icmp-type 1/1
+ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6  --ip6-icmp-type 1/1
 nft add rule bridge filter FORWARD icmpv6 type 1 icmpv6 code 1 counter
 
-ebtables-translate -A FORWARD --ip6-icmp-type ! 1:10
+ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type ! 1:10
 nft add rule bridge filter FORWARD icmpv6 type != 1-10 counter

diff --git a/extensions/libebt_vlan.txlate b/extensions/libebt_vlan.txlate
index fe1ec141580a9e1029906a365d1a48891f236090..2ab62d5335ab7137bdd526b925cb48847361eaa7 100644 (file)
--- a/extensions/libebt_vlan.txlate
+++ b/extensions/libebt_vlan.txlate
@@ -1,11 +1,11 @@
-ebtables-translate -A INPUT --vlan-id 42
+ebtables-translate -A INPUT -p 802_1Q --vlan-id 42
 nft add rule bridge filter INPUT vlan id 42 counter
 
-ebtables-translate -A INPUT --vlan-prio ! 1
+ebtables-translate -A INPUT -p 802_1Q --vlan-prio ! 1
 nft add rule bridge filter INPUT vlan pcp != 1 counter
 
-ebtables-translate -A INPUT --vlan-encap ip
+ebtables-translate -A INPUT -p 802_1Q --vlan-encap ip
 nft add rule bridge filter INPUT vlan type 0x0800 counter
 
-ebtables-translate -A INPUT --vlan-encap ipv6 ! --vlan-id 1
+ebtables-translate -A INPUT -p 802_1Q --vlan-encap ipv6 ! --vlan-id 1
 nft add rule bridge filter INPUT vlan id != 1 vlan type 0x86dd counter

diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
index bf8949a5f39bef94712ee93474e4a2a71738ef1f..fb19fea39d905569829d53ce7e541a44c1e6be0e 100644 (file)
--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
@@ -650,9 +650,26 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)
                     cs->eb.invflags & EBT_ILOGICALOUT);
 
        if ((cs->eb.bitmask & EBT_NOPROTO) == 0) {
-               xt_xlate_add(xl, "ether type %s 0x%x ",
-                            cs->eb.invflags & EBT_IPROTO ? "!= " : "",
-                            ntohs(cs->eb.ethproto));
+               const char *implicit = NULL;
+
+               switch (ntohs(cs->eb.ethproto)) {
+               case ETH_P_IP:
+                       implicit = "ip";
+                       break;
+               case ETH_P_IPV6:
+                       implicit = "ip6";
+                       break;
+               case ETH_P_8021Q:
+                       implicit = "vlan";
+                       break;
+               default:
+                       break;
+               }
+
+               if (!implicit || !xlate_find_match(cs, implicit))
+                       xt_xlate_add(xl, "ether type %s 0x%x ",
+                                    cs->eb.invflags & EBT_IPROTO ? "!= " : "",
+                                    ntohs(cs->eb.ethproto));
        }
 
        if (cs->eb.bitmask & EBT_802_3)