diff options
| author | Florian Westphal <fw@strlen.de> | 2017-03-22 15:08:48 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2017-05-19 09:41:22 +0200 |
| commit | 2366ed9ffcb4f5f5341f10f0a1d1a4688d37ad87 (patch) | |
| tree | fb0e497da03ec9c3be4207ec93119b51bad6dc5f /src/proto.c | |
| parent | 9a1f2bbf3cd2417e0c10d18578e224abe2071d68 (diff) | |
src: ipv6: switch implicit dependencies to meta l4proto
when using rule like
ip6 filter input tcp dport 22
nft generates:
[ payload load 1b @ network header + 6 => reg 1 ]
[ cmp eq reg 1 0x00000006 ]
[ payload load 2b @ transport header + 2 => reg 1 ]
[ cmp eq reg 1 0x00001600 ]
which is: ip6 filter input ip6 nexthdr tcp dport 22
IOW, such a rule won't match if e.g. a fragment header is in place.
This changes ip6_proto to use 'meta l4proto' which is the protocol header
found by exthdr walk.
A side effect is that for bridge we get a shorter dependency chain as it
no longer needs to prepend 'ether proto ipv6' for old 'ip6 nexthdr' dep.
Only problem:
ip6 nexthdr tcp tcp dport 22
will now inject a (useless) meta l4 dependency as ip6 nexthdr is no
longer flagged as EXPR_F_PROTOCOL, to avoid this add a small helper
that skips the unneded meta dependency in that case.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/proto.c')
| -rw-r--r-- | src/proto.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/proto.c b/src/proto.c index fcdfbe73..3b20a5fd 100644 --- a/src/proto.c +++ b/src/proto.c @@ -707,7 +707,6 @@ const struct proto_desc proto_icmp6 = { const struct proto_desc proto_ip6 = { .name = "ip6", .base = PROTO_BASE_NETWORK_HDR, - .protocol_key = IP6HDR_NEXTHDR, .protocols = { PROTO_LINK(IPPROTO_ESP, &proto_esp), PROTO_LINK(IPPROTO_AH, &proto_ah), @@ -720,6 +719,7 @@ const struct proto_desc proto_ip6 = { PROTO_LINK(IPPROTO_ICMPV6, &proto_icmp6), }, .templates = { + [0] = PROTO_META_TEMPLATE("l4proto", &inet_protocol_type, NFT_META_L4PROTO, 8), [IP6HDR_VERSION] = HDR_BITFIELD("version", &integer_type, 0, 4), [IP6HDR_DSCP] = HDR_BITFIELD("dscp", &dscp_type, 4, 6), [IP6HDR_ECN] = HDR_BITFIELD("ecn", &ecn_type, 10, 2), |