[PATCH v2] netfilter: payload mangling

[Patrick McHardy <kaber@trash.net>]

Following is the latest version of the payload mangling patch. Changes
to the last version are:

* Make checksum updates optional, required for some protocols

* Fix mangling headers before skb->data. Previously skb_make_writable() would
  fail due to negative lengths.

* Add new struct for set operation to avoid bloating the regular payload struct

The patch has been tested with headers on all header bases.

The last remaining question is how to react to failure. For data loading
expressions we simply NFT_BREAK, which is reasonable since they're used in
match like constructs.

For statements that are actions on the packet, I'd say we should drop the
packet if the action fails. However we don't do this so far anywhere else,
so I wanted to bring it up first since it might also be relevant for other
actions, "ct" comes to mind.


Patrick McHardy (1):
  netfilter: nft_payload: add packet mangling support

 include/net/netfilter/nf_tables_core.h   |   9 +++
 include/uapi/linux/netfilter/nf_tables.h |  17 ++++
 net/netfilter/nft_payload.c              | 135 +++++++++++++++++++++++++++++--
 3 files changed, 155 insertions(+), 6 deletions(-)

-- 
2.5.0