summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2016-03-02 13:56:43 +0100
committerFlorian Westphal <fw@strlen.de>2016-03-02 13:56:43 +0100
commit10e0a903735f64c4b645445296664387d1524218 (patch)
tree2c9956bfadd0d0cdf56c0a0f927b6b6ce2502a93
parentff04f644d8b3ebb32d297b3d06fb965c8b616cf8 (diff)
exthdr: generate dependencies for inet/bridge/netdev family
Should treat this as if user would have asked to match ipv6 header field. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--include/payload.h2
-rw-r--r--src/evaluate.c17
-rw-r--r--src/payload.c15
3 files changed, 31 insertions, 3 deletions
diff --git a/include/payload.h b/include/payload.h
index 9192d6e5..a19e6906 100644
--- a/include/payload.h
+++ b/include/payload.h
@@ -14,6 +14,8 @@ struct eval_ctx;
struct stmt;
extern int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
struct stmt **res);
+extern int exthdr_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
+ struct stmt **res);
extern bool payload_is_adjacent(const struct expr *e1, const struct expr *e2);
extern struct expr *payload_expr_join(const struct expr *e1,
diff --git a/src/evaluate.c b/src/evaluate.c
index 47a1f8ca..28e17cb2 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -344,18 +344,29 @@ conflict_resolution_gen_dependency(struct eval_ctx *ctx, int protocol,
}
/*
- * Exthdr expression: check whether dependencies are fulfilled.
+ * Exthdr expression: check whether dependencies are fulfilled, otherwise
+ * generate the necessary relational expression and prepend it to the current
+ * statement.
*/
static int expr_evaluate_exthdr(struct eval_ctx *ctx, struct expr **expr)
{
const struct proto_desc *base;
+ struct stmt *nstmt;
base = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
if (base == &proto_ip6)
return expr_evaluate_primary(ctx, expr);
- return expr_error(ctx->msgs, *expr,
- "exthdr can only be used with ipv6");
+ if (base)
+ return expr_error(ctx->msgs, *expr,
+ "cannot use exthdr with %s", base->name);
+
+ if (exthdr_gen_dependency(ctx, *expr, &nstmt) < 0)
+ return -1;
+
+ list_add(&nstmt->list, &ctx->rule->stmts);
+
+ return expr_evaluate_primary(ctx, expr);
}
/* dependency supersede.
diff --git a/src/payload.c b/src/payload.c
index 8f67b6ec..7e380617 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -302,6 +302,21 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
return payload_add_dependency(ctx, desc, expr->payload.desc, expr, res);
}
+int exthdr_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
+ struct stmt **res)
+{
+ const struct proto_desc *desc;
+
+ desc = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
+ if (desc == NULL)
+ return expr_error(ctx->msgs, expr,
+ "Cannot generate dependency: "
+ "no %s protocol specified",
+ proto_base_names[PROTO_BASE_LL_HDR]);
+
+ return payload_add_dependency(ctx, desc, &proto_ip6, expr, res);
+}
+
/**
* payload_expr_complete - fill in type information of a raw payload expr
*