[PATCH nft 1/2] ipopt: use ipv4 address datatype for address field in ip options

[PATCH nft 1/2] ipopt: use ipv4 address datatype for address field in ip options

[Pablo Neira Ayuso]

So user does not have to play integer arithmetics to match on IPv4
address.

Before:

 # nft describe ip option lsrr addr
 exthdr expression, datatype integer (integer), 32 bits

After:

 # nft describe ip option lsrr addr
 exthdr expression, datatype ipv4_addr (IPv4 address) (basetype integer), 32 bits

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/ipopt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/ipopt.c b/src/ipopt.c
index 37f779d468ab..ddb42f5712d4 100644
--- a/src/ipopt.c
+++ b/src/ipopt.c
@@ -24,7 +24,7 @@ static const struct exthdr_desc ipopt_lsrr = {
 		[IPOPT_FIELD_TYPE]		= PHT("type",    0,  8),
 		[IPOPT_FIELD_LENGTH]		= PHT("length",  8,  8),
 		[IPOPT_FIELD_PTR]		= PHT("ptr",    16,  8),
-		[IPOPT_FIELD_ADDR_0]		= PHT("addr",   24, 32),
+		[IPOPT_FIELD_ADDR_0]		= PROTO_HDR_TEMPLATE("addr", &ipaddr_type, BYTEORDER_BIG_ENDIAN, 24, 32),
 	},
 };
 
@@ -35,7 +35,7 @@ static const struct exthdr_desc ipopt_rr = {
 		[IPOPT_FIELD_TYPE]		= PHT("type",   0,   8),
 		[IPOPT_FIELD_LENGTH]		= PHT("length",  8,  8),
 		[IPOPT_FIELD_PTR]		= PHT("ptr",    16,  8),
-		[IPOPT_FIELD_ADDR_0]		= PHT("addr",   24, 32),
+		[IPOPT_FIELD_ADDR_0]		= PROTO_HDR_TEMPLATE("addr", &ipaddr_type, BYTEORDER_BIG_ENDIAN, 24, 32),
 	},
 };
 
@@ -46,7 +46,7 @@ static const struct exthdr_desc ipopt_ssrr = {
 		[IPOPT_FIELD_TYPE]		= PHT("type",   0,   8),
 		[IPOPT_FIELD_LENGTH]		= PHT("length",  8,  8),
 		[IPOPT_FIELD_PTR]		= PHT("ptr",    16,  8),
-		[IPOPT_FIELD_ADDR_0]		= PHT("addr",   24, 32),
+		[IPOPT_FIELD_ADDR_0]		= PROTO_HDR_TEMPLATE("addr", &ipaddr_type, BYTEORDER_BIG_ENDIAN, 24, 32),
 	},
 };
 
@@ -56,7 +56,7 @@ static const struct exthdr_desc ipopt_ra = {
 	.templates	= {
 		[IPOPT_FIELD_TYPE]		= PHT("type",   0,   8),
 		[IPOPT_FIELD_LENGTH]		= PHT("length", 8,   8),
-		[IPOPT_FIELD_VALUE]		= PHT("value",  16, 16),
+		[IPOPT_FIELD_ADDR_0]		= PROTO_HDR_TEMPLATE("addr", &ipaddr_type, BYTEORDER_BIG_ENDIAN, 24, 32),
 	},
 };
 
-- 
2.30.2

[PATCH nft 2/2] parser_bison: turn redudant ip option type field match into boolean

[Pablo Neira Ayuso]

The ip option expression allows for non-sense matching like:

	ip option lsrr type 1

because 'lsrr' already provides the type field, this never results in a
matching.

Turn this expression into:

	ip option lsrr exists

And update documentation to hide this redundant type field.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 doc/payload-expression.txt | 8 ++++----
 src/parser_bison.y         | 3 +++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
index 7bc24a8a6502..2a155aa87b6f 100644
--- a/doc/payload-expression.txt
+++ b/doc/payload-expression.txt
@@ -808,16 +808,16 @@ TCP option matching also supports raw expression syntax to access arbitrary opti
 |Keyword| Description | IP option fields
 |lsrr|
 Loose Source Route |
-type, length, ptr, addr
+length, ptr, addr
 |ra|
 Router Alert |
-type, length, value
+length, value
 |rr|
 Record Route |
-type, length, ptr, addr
+length, ptr, addr
 |ssrr|
 Strict Source Route |
-type, length, ptr, addr
+length, ptr, addr
 |============================
 
 .finding TCP options
diff --git a/src/parser_bison.y b/src/parser_bison.y
index c8714812532d..d15bf212489d 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -5698,6 +5698,9 @@ ip_hdr_expr		:	IP	ip_hdr_field	close_scope_ip
 					erec_queue(error(&@1, "unknown ip option type/field"), state->msgs);
 					YYERROR;
 				}
+
+				if ($4 == IPOPT_FIELD_TYPE)
+					$$->exthdr.flags = NFT_EXTHDR_F_PRESENT;
 			}
 			|	IP	OPTION	ip_option_type close_scope_ip
 			{
-- 
2.30.2

Re: [PATCH nft 2/2] parser_bison: turn redudant ip option type field match into boolean

[Alexey Kashavkin]

I suggest adding the following note about the addr field.

diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
index 7bc24a8a..9a7ac396 100644
--- a/doc/payload-expression.txt
+++ b/doc/payload-expression.txt
@@ -820,6 +820,8 @@ Strict Source Route |
 type, length, ptr, addr
 |============================
 
+Note: Only the first IP address is specified in the addr field.
+
 .finding TCP options
 --------------------
 filter input tcp option sack-perm exists counter

Re: [PATCH nft 2/2] parser_bison: turn redudant ip option type field match into boolean

[Pablo Neira Ayuso]

Hi,

On Wed, Feb 05, 2025 at 03:29:10PM +0300, Alexey Kashavkin wrote:
> I suggest adding the following note about the addr field.
> 
> diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
> index 7bc24a8a..9a7ac396 100644
> --- a/doc/payload-expression.txt
> +++ b/doc/payload-expression.txt
> @@ -820,6 +820,8 @@ Strict Source Route |
>  type, length, ptr, addr
>  |============================
>  
> +Note: Only the first IP address is specified in the addr field.

It should be not too complicated to extend this to match on any
address.

> +
>  .finding TCP options
>  --------------------
>  filter input tcp option sack-perm exists counter
> 
> 

Re: [PATCH nft 2/2] parser_bison: turn redudant ip option type field match into boolean

[Alexey Kashavkin]

Hi Pablo,

Yes, I agree. If a template field like IPOPT_FIELD_ADDR_N with the required offset will be added.

> On 6 Feb 2025, at 14:55, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> 
> It should be not too complicated to extend this to match on any
> address.

Re: [PATCH nft 2/2] parser_bison: turn redudant ip option type field match into boolean

[Pablo Neira Ayuso]

On Thu, Feb 06, 2025 at 03:02:38PM +0300, Alexey Kashavkin wrote:
> Hi Pablo,
> 
> Yes, I agree. If a template field like IPOPT_FIELD_ADDR_N with the required offset will be added.

Something like:

addr[1] -> first IP address
addr[2] -> second IP address
...