diff options
| author | Jeremy Sowden <jeremy@azazel.net> | 2023-04-11 21:45:34 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-06-01 21:43:16 +0200 |
| commit | 6ab0fd6c67dbccedb49209b94eb7f740dd32fd2a (patch) | |
| tree | 8f376a718fd3c1bc28577a6fb00ec5c3ccdf9133 /src/parser_bison.y | |
| parent | 19245dd1e0c8e1e007a3b98527e379337d57b49a (diff) | |
exthdr: add boolean DCCP option matching
Iptables supports the matching of DCCP packets based on the presence
or absence of DCCP options. Extend exthdr expressions to add this
functionality to nftables.
Link: https://bugzilla.netfilter.org/show_bug.cgi?id=930
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/parser_bison.y')
| -rw-r--r-- | src/parser_bison.y | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/parser_bison.y b/src/parser_bison.y index 90a2b9c3..763c1b2d 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -5968,6 +5968,15 @@ dccp_hdr_expr : DCCP dccp_hdr_field close_scope_dccp { $$ = payload_expr_alloc(&@$, &proto_dccp, $2); } + | DCCP OPTION NUM close_scope_dccp + { + if ($3 > DCCPOPT_TYPE_MAX) { + erec_queue(error(&@1, "value too large"), + state->msgs); + YYERROR; + } + $$ = dccpopt_expr_alloc(&@$, $3); + } ; dccp_hdr_field : SPORT { $$ = DCCPHDR_SPORT; } |