Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 1 | From 2366ed9ffcb4f5f5341f10f0a1d1a4688d37ad87 Mon Sep 17 00:00:00 2001 |
| 2 | From: Florian Westphal <fw@strlen.de> |
| 3 | Date: Wed, 22 Mar 2017 15:08:48 +0100 |
| 4 | Subject: [PATCH 3/4] src: ipv6: switch implicit dependencies to meta l4proto |
| 5 | |
| 6 | when using rule like |
| 7 | |
| 8 | ip6 filter input tcp dport 22 |
| 9 | nft generates: |
| 10 | [ payload load 1b @ network header + 6 => reg 1 ] |
| 11 | [ cmp eq reg 1 0x00000006 ] |
| 12 | [ payload load 2b @ transport header + 2 => reg 1 ] |
| 13 | [ cmp eq reg 1 0x00001600 ] |
| 14 | |
| 15 | which is: ip6 filter input ip6 nexthdr tcp dport 22 |
| 16 | IOW, such a rule won't match if e.g. a fragment header is in place. |
| 17 | |
| 18 | This changes ip6_proto to use 'meta l4proto' which is the protocol header |
| 19 | found by exthdr walk. |
| 20 | |
| 21 | A side effect is that for bridge we get a shorter dependency chain as it |
| 22 | no longer needs to prepend 'ether proto ipv6' for old 'ip6 nexthdr' dep. |
| 23 | |
| 24 | Only problem: |
| 25 | |
| 26 | ip6 nexthdr tcp tcp dport 22 |
| 27 | will now inject a (useless) meta l4 dependency as ip6 nexthdr is no |
| 28 | longer flagged as EXPR_F_PROTOCOL, to avoid this add a small helper |
| 29 | that skips the unneded meta dependency in that case. |
| 30 | |
| 31 | Signed-off-by: Florian Westphal <fw@strlen.de> |
| 32 | --- |
| 33 | Upstream-Status: Backport |
| 34 | Signed-off-by: André Draszik <adraszik@tycoint.com> |
| 35 | src/payload.c | 19 ++++++++++++++++++- |
| 36 | src/proto.c | 2 +- |
| 37 | 2 files changed, 19 insertions(+), 2 deletions(-) |
| 38 | |
| 39 | diff --git a/src/payload.c b/src/payload.c |
| 40 | index 31e5a02..38db15e 100644 |
| 41 | --- a/src/payload.c |
| 42 | +++ b/src/payload.c |
| 43 | @@ -117,6 +117,23 @@ static const struct expr_ops payload_expr_ops = { |
| 44 | .pctx_update = payload_expr_pctx_update, |
| 45 | }; |
| 46 | |
| 47 | +/* |
| 48 | + * ipv6 is special case, we normally use 'meta l4proto' to fetch the last |
| 49 | + * l4 header of the ipv6 extension header chain so we will also match |
| 50 | + * tcp after a fragmentation header, for instance. |
| 51 | + * |
| 52 | + * If user specifically asks for nexthdr x, treat is as a full |
| 53 | + * dependency rather than injecting another (useless) meta l4 one. |
| 54 | + */ |
| 55 | +static bool proto_key_is_protocol(const struct proto_desc *desc, unsigned int type) |
| 56 | +{ |
| 57 | + if (type == desc->protocol_key || |
| 58 | + (desc == &proto_ip6 && type == IP6HDR_NEXTHDR)) |
| 59 | + return true; |
| 60 | + |
| 61 | + return false; |
| 62 | +} |
| 63 | + |
| 64 | struct expr *payload_expr_alloc(const struct location *loc, |
| 65 | const struct proto_desc *desc, |
| 66 | unsigned int type) |
| 67 | @@ -129,7 +146,7 @@ struct expr *payload_expr_alloc(const struct location *loc, |
| 68 | if (desc != NULL) { |
| 69 | tmpl = &desc->templates[type]; |
| 70 | base = desc->base; |
| 71 | - if (type == desc->protocol_key) |
| 72 | + if (proto_key_is_protocol(desc, type)) |
| 73 | flags = EXPR_F_PROTOCOL; |
| 74 | } else { |
| 75 | tmpl = &proto_unknown_template; |
| 76 | diff --git a/src/proto.c b/src/proto.c |
| 77 | index fcdfbe7..3b20a5f 100644 |
| 78 | --- a/src/proto.c |
| 79 | +++ b/src/proto.c |
| 80 | @@ -707,7 +707,6 @@ const struct proto_desc proto_icmp6 = { |
| 81 | const struct proto_desc proto_ip6 = { |
| 82 | .name = "ip6", |
| 83 | .base = PROTO_BASE_NETWORK_HDR, |
| 84 | - .protocol_key = IP6HDR_NEXTHDR, |
| 85 | .protocols = { |
| 86 | PROTO_LINK(IPPROTO_ESP, &proto_esp), |
| 87 | PROTO_LINK(IPPROTO_AH, &proto_ah), |
| 88 | @@ -720,6 +719,7 @@ const struct proto_desc proto_ip6 = { |
| 89 | PROTO_LINK(IPPROTO_ICMPV6, &proto_icmp6), |
| 90 | }, |
| 91 | .templates = { |
| 92 | + [0] = PROTO_META_TEMPLATE("l4proto", &inet_protocol_type, NFT_META_L4PROTO, 8), |
| 93 | [IP6HDR_VERSION] = HDR_BITFIELD("version", &integer_type, 0, 4), |
| 94 | [IP6HDR_DSCP] = HDR_BITFIELD("dscp", &dscp_type, 4, 6), |
| 95 | [IP6HDR_ECN] = HDR_BITFIELD("ecn", &ecn_type, 10, 2), |
| 96 | -- |
| 97 | 2.11.0 |
| 98 | |