| Message ID | 20190620115429.3678-1-ssuryaextr@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [libnftnl,v2] src: libnftnl: add support for matching IPv4 options | expand |
On Thu, Jun 20, 2019 at 07:54:29AM -0400, Stephen Suryaputra wrote: [...] > diff --git a/src/expr/exthdr.c b/src/expr/exthdr.c > index bef453e..e5f714b 100644 > --- a/src/expr/exthdr.c > +++ b/src/expr/exthdr.c > @@ -200,6 +200,9 @@ static const char *op2str(uint8_t op) > case NFT_EXTHDR_OP_TCPOPT: > return " tcpopt"; > case NFT_EXTHDR_OP_IPV6: > + return " ipv6"; > + case NFT_EXTHDR_OP_IPV4: > + return " ipv4"; > default: > return ""; > } Would you mind to install libnftnl with this patch on top and run: nftables/tests/py/# python nft-tests.py to check if this breaks testcases, if so a patch to update tests in nftables would be great too. Thanks! > @@ -209,6 +212,8 @@ static inline int str2exthdr_op(const char* str) > { > if (!strcmp(str, "tcpopt")) > return NFT_EXTHDR_OP_TCPOPT; > + if (!strcmp(str, "ipv4")) > + return NFT_EXTHDR_OP_IPV4; > > /* if str == "ipv6" or anything else */ > return NFT_EXTHDR_OP_IPV6; > -- > 2.17.1 >
On Fri, Jun 21, 2019 at 06:06:53PM +0200, Pablo Neira Ayuso wrote: > > Would you mind to install libnftnl with this patch on top and run: > > nftables/tests/py/# python nft-tests.py > > to check if this breaks testcases, if so a patch to update tests in > nftables would be great too. Updated the testcases payload files. Will spin another nftables patch version. Thanks, Stephen.
On Thu, Jun 20, 2019 at 07:54:29AM -0400, Stephen Suryaputra wrote: > This is the libnftnl change for the overall changes with this > description: > Add capability to have rules matching IPv4 options. This is developed > mainly to support dropping of IP packets with loose and/or strict source > route route options. Applied, thanks.
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index fd38cdc..a5e9bf3 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -729,10 +729,12 @@ enum nft_exthdr_flags { * * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers * @NFT_EXTHDR_OP_TCP: match against tcp options + * @NFT_EXTHDR_OP_IPV4: match against ipv4 options */ enum nft_exthdr_op { NFT_EXTHDR_OP_IPV6, NFT_EXTHDR_OP_TCPOPT, + NFT_EXTHDR_OP_IPV4, __NFT_EXTHDR_OP_MAX }; #define NFT_EXTHDR_OP_MAX (__NFT_EXTHDR_OP_MAX - 1) diff --git a/src/expr/exthdr.c b/src/expr/exthdr.c index bef453e..e5f714b 100644 --- a/src/expr/exthdr.c +++ b/src/expr/exthdr.c @@ -200,6 +200,9 @@ static const char *op2str(uint8_t op) case NFT_EXTHDR_OP_TCPOPT: return " tcpopt"; case NFT_EXTHDR_OP_IPV6: + return " ipv6"; + case NFT_EXTHDR_OP_IPV4: + return " ipv4"; default: return ""; } @@ -209,6 +212,8 @@ static inline int str2exthdr_op(const char* str) { if (!strcmp(str, "tcpopt")) return NFT_EXTHDR_OP_TCPOPT; + if (!strcmp(str, "ipv4")) + return NFT_EXTHDR_OP_IPV4; /* if str == "ipv6" or anything else */ return NFT_EXTHDR_OP_IPV6;
This is the libnftnl change for the overall changes with this description: Add capability to have rules matching IPv4 options. This is developed mainly to support dropping of IP packets with loose and/or strict source route route options. v2: Remove statements about supporting other options to reflect what are supported in the kernel. Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com> --- include/linux/netfilter/nf_tables.h | 2 ++ src/expr/exthdr.c | 5 +++++ 2 files changed, 7 insertions(+)