1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
From 2366ed9ffcb4f5f5341f10f0a1d1a4688d37ad87 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 22 Mar 2017 15:08:48 +0100
Subject: [PATCH 3/4] src: ipv6: switch implicit dependencies to meta l4proto
when using rule like
ip6 filter input tcp dport 22
nft generates:
[ payload load 1b @ network header + 6 => reg 1 ]
[ cmp eq reg 1 0x00000006 ]
[ payload load 2b @ transport header + 2 => reg 1 ]
[ cmp eq reg 1 0x00001600 ]
which is: ip6 filter input ip6 nexthdr tcp dport 22
IOW, such a rule won't match if e.g. a fragment header is in place.
This changes ip6_proto to use 'meta l4proto' which is the protocol header
found by exthdr walk.
A side effect is that for bridge we get a shorter dependency chain as it
no longer needs to prepend 'ether proto ipv6' for old 'ip6 nexthdr' dep.
Only problem:
ip6 nexthdr tcp tcp dport 22
will now inject a (useless) meta l4 dependency as ip6 nexthdr is no
longer flagged as EXPR_F_PROTOCOL, to avoid this add a small helper
that skips the unneded meta dependency in that case.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
Upstream-Status: Backport
Signed-off-by: André Draszik <adraszik@tycoint.com>
src/payload.c | 19 ++++++++++++++++++-
src/proto.c | 2 +-
2 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/src/payload.c b/src/payload.c
index 31e5a02..38db15e 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -117,6 +117,23 @@ static const struct expr_ops payload_expr_ops = {
.pctx_update = payload_expr_pctx_update,
};
+/*
+ * ipv6 is special case, we normally use 'meta l4proto' to fetch the last
+ * l4 header of the ipv6 extension header chain so we will also match
+ * tcp after a fragmentation header, for instance.
+ *
+ * If user specifically asks for nexthdr x, treat is as a full
+ * dependency rather than injecting another (useless) meta l4 one.
+ */
+static bool proto_key_is_protocol(const struct proto_desc *desc, unsigned int type)
+{
+ if (type == desc->protocol_key ||
+ (desc == &proto_ip6 && type == IP6HDR_NEXTHDR))
+ return true;
+
+ return false;
+}
+
struct expr *payload_expr_alloc(const struct location *loc,
const struct proto_desc *desc,
unsigned int type)
@@ -129,7 +146,7 @@ struct expr *payload_expr_alloc(const struct location *loc,
if (desc != NULL) {
tmpl = &desc->templates[type];
base = desc->base;
- if (type == desc->protocol_key)
+ if (proto_key_is_protocol(desc, type))
flags = EXPR_F_PROTOCOL;
} else {
tmpl = &proto_unknown_template;
diff --git a/src/proto.c b/src/proto.c
index fcdfbe7..3b20a5f 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -707,7 +707,6 @@ const struct proto_desc proto_icmp6 = {
const struct proto_desc proto_ip6 = {
.name = "ip6",
.base = PROTO_BASE_NETWORK_HDR,
- .protocol_key = IP6HDR_NEXTHDR,
.protocols = {
PROTO_LINK(IPPROTO_ESP, &proto_esp),
PROTO_LINK(IPPROTO_AH, &proto_ah),
@@ -720,6 +719,7 @@ const struct proto_desc proto_ip6 = {
PROTO_LINK(IPPROTO_ICMPV6, &proto_icmp6),
},
.templates = {
+ [0] = PROTO_META_TEMPLATE("l4proto", &inet_protocol_type, NFT_META_L4PROTO, 8),
[IP6HDR_VERSION] = HDR_BITFIELD("version", &integer_type, 0, 4),
[IP6HDR_DSCP] = HDR_BITFIELD("dscp", &dscp_type, 4, 6),
[IP6HDR_ECN] = HDR_BITFIELD("ecn", &ecn_type, 10, 2),
--
2.11.0
|
