diff options
author | Florian Westphal <fw@strlen.de> | 2016-03-02 13:56:43 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2016-03-02 13:56:43 +0100 |
commit | 10e0a903735f64c4b645445296664387d1524218 (patch) | |
tree | 2c9956bfadd0d0cdf56c0a0f927b6b6ce2502a93 /src/evaluate.c | |
parent | ff04f644d8b3ebb32d297b3d06fb965c8b616cf8 (diff) |
exthdr: generate dependencies for inet/bridge/netdev family
Should treat this as if user would have asked to match ipv6 header field.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/evaluate.c')
-rw-r--r-- | src/evaluate.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 47a1f8ca..28e17cb2 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -344,18 +344,29 @@ conflict_resolution_gen_dependency(struct eval_ctx *ctx, int protocol, } /* - * Exthdr expression: check whether dependencies are fulfilled. + * Exthdr expression: check whether dependencies are fulfilled, otherwise + * generate the necessary relational expression and prepend it to the current + * statement. */ static int expr_evaluate_exthdr(struct eval_ctx *ctx, struct expr **expr) { const struct proto_desc *base; + struct stmt *nstmt; base = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; if (base == &proto_ip6) return expr_evaluate_primary(ctx, expr); - return expr_error(ctx->msgs, *expr, - "exthdr can only be used with ipv6"); + if (base) + return expr_error(ctx->msgs, *expr, + "cannot use exthdr with %s", base->name); + + if (exthdr_gen_dependency(ctx, *expr, &nstmt) < 0) + return -1; + + list_add(&nstmt->list, &ctx->rule->stmts); + + return expr_evaluate_primary(ctx, expr); } /* dependency supersede. |