diff options
| -rw-r--r-- | src/payload.c | 19 | ||||
| -rw-r--r-- | src/proto.c | 2 |
2 files changed, 19 insertions, 2 deletions
diff --git a/src/payload.c b/src/payload.c index 31e5a024..38db15ee 100644 --- a/src/payload.c +++ b/src/payload.c @@ -117,6 +117,23 @@ static const struct expr_ops payload_expr_ops = { .pctx_update = payload_expr_pctx_update, }; +/* + * ipv6 is special case, we normally use 'meta l4proto' to fetch the last + * l4 header of the ipv6 extension header chain so we will also match + * tcp after a fragmentation header, for instance. + * + * If user specifically asks for nexthdr x, treat is as a full + * dependency rather than injecting another (useless) meta l4 one. + */ +static bool proto_key_is_protocol(const struct proto_desc *desc, unsigned int type) +{ + if (type == desc->protocol_key || + (desc == &proto_ip6 && type == IP6HDR_NEXTHDR)) + return true; + + return false; +} + struct expr *payload_expr_alloc(const struct location *loc, const struct proto_desc *desc, unsigned int type) @@ -129,7 +146,7 @@ struct expr *payload_expr_alloc(const struct location *loc, if (desc != NULL) { tmpl = &desc->templates[type]; base = desc->base; - if (type == desc->protocol_key) + if (proto_key_is_protocol(desc, type)) flags = EXPR_F_PROTOCOL; } else { tmpl = &proto_unknown_template; diff --git a/src/proto.c b/src/proto.c index fcdfbe73..3b20a5fd 100644 --- a/src/proto.c +++ b/src/proto.c @@ -707,7 +707,6 @@ const struct proto_desc proto_icmp6 = { const struct proto_desc proto_ip6 = { .name = "ip6", .base = PROTO_BASE_NETWORK_HDR, - .protocol_key = IP6HDR_NEXTHDR, .protocols = { PROTO_LINK(IPPROTO_ESP, &proto_esp), PROTO_LINK(IPPROTO_AH, &proto_ah), @@ -720,6 +719,7 @@ const struct proto_desc proto_ip6 = { PROTO_LINK(IPPROTO_ICMPV6, &proto_icmp6), }, .templates = { + [0] = PROTO_META_TEMPLATE("l4proto", &inet_protocol_type, NFT_META_L4PROTO, 8), [IP6HDR_VERSION] = HDR_BITFIELD("version", &integer_type, 0, 4), [IP6HDR_DSCP] = HDR_BITFIELD("dscp", &dscp_type, 4, 6), [IP6HDR_ECN] = HDR_BITFIELD("ecn", &ecn_type, 10, 2), |