diff options
author | Manuel Messner <mm@skelett.io> | 2017-02-07 03:14:12 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2017-02-12 15:34:47 +0100 |
commit | 864a1b44e1937a42753648644a812f70f9500a73 (patch) | |
tree | 97976d52c9d08746bd68d611be1c8443090475da /src/netlink_linearize.c | |
parent | 9574c263569f477114d7885ebcf5af8af6411582 (diff) |
src: add TCP option matching
This patch enables nft to match against TCP options.
Currently these TCP options are supported:
* End of Option List (eol)
* No-Operation (noop)
* Maximum Segment Size (maxseg)
* Window Scale (window)
* SACK Permitted (sack_permitted)
* SACK (sack)
* Timestamps (timestamp)
Syntax: tcp options $option_name [$offset] $field_name
Example:
# count all incoming packets with a specific maximum segment size `x`
# nft add rule filter input tcp option maxseg size x counter
# count all incoming packets with a SACK TCP option where the third
# (counted from zero) left field is greater `x`.
# nft add rule filter input tcp option sack 2 left \> x counter
If the offset (the `2` in the example above) is zero, it can optionally
be omitted.
For all non-SACK TCP options it is always zero, thus can be left out.
Option names and field names are parsed from templates, similar to meta
and ct options rather than via keywords to prevent adding more keywords
than necessary.
Signed-off-by: Manuel Messner <mm@skelett.io>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/netlink_linearize.c')
-rw-r--r-- | src/netlink_linearize.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 056f1131..8849b0e4 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -162,7 +162,7 @@ static void netlink_gen_exthdr(struct netlink_linearize_ctx *ctx, const struct expr *expr, enum nft_registers dreg) { - unsigned int offset = expr->exthdr.tmpl->offset; + unsigned int offset = expr->exthdr.tmpl->offset + expr->exthdr.offset; struct nftnl_expr *nle; nle = alloc_nft_expr("exthdr"); @@ -172,6 +172,7 @@ static void netlink_gen_exthdr(struct netlink_linearize_ctx *ctx, nftnl_expr_set_u32(nle, NFTNL_EXPR_EXTHDR_OFFSET, offset / BITS_PER_BYTE); nftnl_expr_set_u32(nle, NFTNL_EXPR_EXTHDR_LEN, div_round_up(expr->len, BITS_PER_BYTE)); + nftnl_expr_set_u8(nle, NFTNL_EXPR_EXTHDR_OP, expr->exthdr.op); nftnl_rule_add_expr(ctx->nlr, nle); } |