diff options
| author | Florian Westphal <fw@strlen.de> | 2016-12-11 18:02:34 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2017-08-22 23:51:02 +0200 |
| commit | 0c0b2452bc3c96cf3db09eb8cbf62778a2fd8f6c (patch) | |
| tree | 8ab752666dda2f50c396501f1fb95ff43b90eac1 /src/evaluate.c | |
| parent | d74eed8c9649e9278b69f2cd0fd92f71e3e19cfb (diff) | |
src: add tcp options set support
This adds support for tcp mss mangling:
nft add rule filter input tcp option maxseg size 1200
Its also possible to change other tcp option fields, but
maxseg is one of the more useful ones to change.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/evaluate.c')
| -rw-r--r-- | src/evaluate.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index f52a0843..3989d5e3 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1835,6 +1835,19 @@ static bool stmt_evaluate_payload_need_csum(const struct expr *payload) return desc && desc->checksum_key; } +static int stmt_evaluate_exthdr(struct eval_ctx *ctx, struct stmt *stmt) +{ + struct expr *exthdr; + + if (__expr_evaluate_exthdr(ctx, &stmt->exthdr.expr) < 0) + return -1; + + exthdr = stmt->exthdr.expr; + return stmt_evaluate_arg(ctx, stmt, exthdr->dtype, exthdr->len, + BYTEORDER_BIG_ENDIAN, + &stmt->exthdr.val); +} + static int stmt_evaluate_payload(struct eval_ctx *ctx, struct stmt *stmt) { struct expr *binop, *mask, *and, *payload_bytes; @@ -2700,6 +2713,8 @@ int stmt_evaluate(struct eval_ctx *ctx, struct stmt *stmt) return stmt_evaluate_verdict(ctx, stmt); case STMT_PAYLOAD: return stmt_evaluate_payload(ctx, stmt); + case STMT_EXTHDR: + return stmt_evaluate_exthdr(ctx, stmt); case STMT_FLOW: return stmt_evaluate_flow(ctx, stmt); case STMT_META: |