diff options
author | Florian Westphal <fw@strlen.de> | 2021-12-20 12:30:18 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2022-02-28 22:44:51 +0100 |
commit | 5d837d270d5a8b3a4d3fdca12d0f0800b8287cdd (patch) | |
tree | f6142e001404eaca518ef39eec73b7d1372dd82b /src/statement.c | |
parent | 1d507ce7f1d3c12481ee24bd1dcac2fc1984ee9f (diff) |
src: add tcp option reset support
This allows to replace a tcp option with nops, similar
to the TCPOPTSTRIP feature of iptables.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/statement.c')
-rw-r--r-- | src/statement.c | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/src/statement.c b/src/statement.c index 03c0acf6..30caf9c7 100644 --- a/src/statement.c +++ b/src/statement.c @@ -23,6 +23,7 @@ #include <netinet/ip_icmp.h> #include <netinet/icmp6.h> #include <statement.h> +#include <tcpopt.h> #include <utils.h> #include <list.h> #include <xt.h> @@ -909,6 +910,37 @@ struct stmt *fwd_stmt_alloc(const struct location *loc) return stmt_alloc(loc, &fwd_stmt_ops); } +static void optstrip_stmt_print(const struct stmt *stmt, struct output_ctx *octx) +{ + const struct expr *expr = stmt->optstrip.expr; + + nft_print(octx, "reset "); + expr_print(expr, octx); +} + +static void optstrip_stmt_destroy(struct stmt *stmt) +{ + expr_free(stmt->optstrip.expr); +} + +static const struct stmt_ops optstrip_stmt_ops = { + .type = STMT_OPTSTRIP, + .name = "optstrip", + .print = optstrip_stmt_print, + .json = optstrip_stmt_json, + .destroy = optstrip_stmt_destroy, +}; + +struct stmt *optstrip_stmt_alloc(const struct location *loc, struct expr *e) +{ + struct stmt *stmt = stmt_alloc(loc, &optstrip_stmt_ops); + + e->exthdr.flags |= NFT_EXTHDR_F_PRESENT; + stmt->optstrip.expr = e; + + return stmt; +} + static void tproxy_stmt_print(const struct stmt *stmt, struct output_ctx *octx) { nft_print(octx, "tproxy"); |