From 2366ed9ffcb4f5f5341f10f0a1d1a4688d37ad87 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Wed, 22 Mar 2017 15:08:48 +0100 Subject: src: ipv6: switch implicit dependencies to meta l4proto when using rule like ip6 filter input tcp dport 22 nft generates: [ payload load 1b @ network header + 6 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00001600 ] which is: ip6 filter input ip6 nexthdr tcp dport 22 IOW, such a rule won't match if e.g. a fragment header is in place. This changes ip6_proto to use 'meta l4proto' which is the protocol header found by exthdr walk. A side effect is that for bridge we get a shorter dependency chain as it no longer needs to prepend 'ether proto ipv6' for old 'ip6 nexthdr' dep. Only problem: ip6 nexthdr tcp tcp dport 22 will now inject a (useless) meta l4 dependency as ip6 nexthdr is no longer flagged as EXPR_F_PROTOCOL, to avoid this add a small helper that skips the unneded meta dependency in that case. Signed-off-by: Florian Westphal --- src/payload.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) (limited to 'src/payload.c') diff --git a/src/payload.c b/src/payload.c index 31e5a024..38db15ee 100644 --- a/src/payload.c +++ b/src/payload.c @@ -117,6 +117,23 @@ static const struct expr_ops payload_expr_ops = { .pctx_update = payload_expr_pctx_update, }; +/* + * ipv6 is special case, we normally use 'meta l4proto' to fetch the last + * l4 header of the ipv6 extension header chain so we will also match + * tcp after a fragmentation header, for instance. + * + * If user specifically asks for nexthdr x, treat is as a full + * dependency rather than injecting another (useless) meta l4 one. + */ +static bool proto_key_is_protocol(const struct proto_desc *desc, unsigned int type) +{ + if (type == desc->protocol_key || + (desc == &proto_ip6 && type == IP6HDR_NEXTHDR)) + return true; + + return false; +} + struct expr *payload_expr_alloc(const struct location *loc, const struct proto_desc *desc, unsigned int type) @@ -129,7 +146,7 @@ struct expr *payload_expr_alloc(const struct location *loc, if (desc != NULL) { tmpl = &desc->templates[type]; base = desc->base; - if (type == desc->protocol_key) + if (proto_key_is_protocol(desc, type)) flags = EXPR_F_PROTOCOL; } else { tmpl = &proto_unknown_template; -- cgit v1.2.3