[PATCH libnftnl v2] src: libnftnl: add support for matching IPv4 options

[PATCH libnftnl v2] src: libnftnl: add support for matching IPv4 options

[Stephen Suryaputra]

This is the libnftnl change for the overall changes with this
description:
Add capability to have rules matching IPv4 options. This is developed
mainly to support dropping of IP packets with loose and/or strict source
route route options.

v2: Remove statements about supporting other options to reflect what are
    supported in the kernel.
Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
---
 include/linux/netfilter/nf_tables.h | 2 ++
 src/expr/exthdr.c                   | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index fd38cdc..a5e9bf3 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -729,10 +729,12 @@ enum nft_exthdr_flags {
  *
  * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
  * @NFT_EXTHDR_OP_TCP: match against tcp options
+ * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
  */
 enum nft_exthdr_op {
 	NFT_EXTHDR_OP_IPV6,
 	NFT_EXTHDR_OP_TCPOPT,
+	NFT_EXTHDR_OP_IPV4,
 	__NFT_EXTHDR_OP_MAX
 };
 #define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)
diff --git a/src/expr/exthdr.c b/src/expr/exthdr.c
index bef453e..e5f714b 100644
--- a/src/expr/exthdr.c
+++ b/src/expr/exthdr.c
@@ -200,6 +200,9 @@ static const char *op2str(uint8_t op)
 	case NFT_EXTHDR_OP_TCPOPT:
 		return " tcpopt";
 	case NFT_EXTHDR_OP_IPV6:
+		return " ipv6";
+	case NFT_EXTHDR_OP_IPV4:
+		return " ipv4";
 	default:
 		return "";
 	}
@@ -209,6 +212,8 @@ static inline int str2exthdr_op(const char* str)
 {
 	if (!strcmp(str, "tcpopt"))
 		return NFT_EXTHDR_OP_TCPOPT;
+	if (!strcmp(str, "ipv4"))
+		return NFT_EXTHDR_OP_IPV4;
 
 	/* if str == "ipv6" or anything else */
 	return NFT_EXTHDR_OP_IPV6;
-- 
2.17.1

Re: [PATCH libnftnl v2] src: libnftnl: add support for matching IPv4 options

[Pablo Neira Ayuso]

On Thu, Jun 20, 2019 at 07:54:29AM -0400, Stephen Suryaputra wrote:
[...]
> diff --git a/src/expr/exthdr.c b/src/expr/exthdr.c
> index bef453e..e5f714b 100644
> --- a/src/expr/exthdr.c
> +++ b/src/expr/exthdr.c
> @@ -200,6 +200,9 @@ static const char *op2str(uint8_t op)
>  	case NFT_EXTHDR_OP_TCPOPT:
>  		return " tcpopt";
>  	case NFT_EXTHDR_OP_IPV6:
> +		return " ipv6";
> +	case NFT_EXTHDR_OP_IPV4:
> +		return " ipv4";
>  	default:
>  		return "";
>  	}

Would you mind to install libnftnl with this patch on top and run:

nftables/tests/py/# python nft-tests.py

to check if this breaks testcases, if so a patch to update tests in
nftables would be great too.

Thanks!

> @@ -209,6 +212,8 @@ static inline int str2exthdr_op(const char* str)
>  {
>  	if (!strcmp(str, "tcpopt"))
>  		return NFT_EXTHDR_OP_TCPOPT;
> +	if (!strcmp(str, "ipv4"))
> +		return NFT_EXTHDR_OP_IPV4;
>  
>  	/* if str == "ipv6" or anything else */
>  	return NFT_EXTHDR_OP_IPV6;
> -- 
> 2.17.1
> 

Re: [PATCH libnftnl v2] src: libnftnl: add support for matching IPv4 options

[Stephen Suryaputra]

On Fri, Jun 21, 2019 at 06:06:53PM +0200, Pablo Neira Ayuso wrote:
> 
> Would you mind to install libnftnl with this patch on top and run:
> 
> nftables/tests/py/# python nft-tests.py
> 
> to check if this breaks testcases, if so a patch to update tests in
> nftables would be great too.

Updated the testcases payload files. Will spin another nftables patch
version.

Thanks,
Stephen.

Re: [PATCH libnftnl v2] src: libnftnl: add support for matching IPv4 options

[Pablo Neira Ayuso]

On Thu, Jun 20, 2019 at 07:54:29AM -0400, Stephen Suryaputra wrote:
> This is the libnftnl change for the overall changes with this
> description:
> Add capability to have rules matching IPv4 options. This is developed
> mainly to support dropping of IP packets with loose and/or strict source
> route route options.

Applied, thanks.