From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 01/21] netfilter: nft_exthdr: Add support for existence check
Date: Sun, 12 Feb 2017 20:42:33 +0100 [thread overview]
Message-ID: <1486928573-24773-2-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1486928573-24773-1-git-send-email-pablo@netfilter.org>
From: Phil Sutter <phil@nwl.cc>
If NFT_EXTHDR_F_PRESENT is set, exthdr will not copy any header field
data into *dest, but instead set it to 1 if the header is found and 0
otherwise.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_tables.h | 6 ++++++
net/netfilter/nft_exthdr.c | 22 ++++++++++++++++++++--
2 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 7b730cab99bd..53aac8b8ed6b 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -704,6 +704,10 @@ enum nft_payload_attributes {
};
#define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
+enum nft_exthdr_flags {
+ NFT_EXTHDR_F_PRESENT = (1 << 0),
+};
+
/**
* enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes
*
@@ -711,6 +715,7 @@ enum nft_payload_attributes {
* @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
* @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
* @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
+ * @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)
*/
enum nft_exthdr_attributes {
NFTA_EXTHDR_UNSPEC,
@@ -718,6 +723,7 @@ enum nft_exthdr_attributes {
NFTA_EXTHDR_TYPE,
NFTA_EXTHDR_OFFSET,
NFTA_EXTHDR_LEN,
+ NFTA_EXTHDR_FLAGS,
__NFTA_EXTHDR_MAX
};
#define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1)
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 47beb3abcc9d..a89e5ab150db 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -23,6 +23,7 @@ struct nft_exthdr {
u8 offset;
u8 len;
enum nft_registers dreg:8;
+ u8 flags;
};
static void nft_exthdr_eval(const struct nft_expr *expr,
@@ -35,8 +36,12 @@ static void nft_exthdr_eval(const struct nft_expr *expr,
int err;
err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
- if (err < 0)
+ if (priv->flags & NFT_EXTHDR_F_PRESENT) {
+ *dest = (err >= 0);
+ return;
+ } else if (err < 0) {
goto err;
+ }
offset += priv->offset;
dest[priv->len / NFT_REG32_SIZE] = 0;
@@ -52,6 +57,7 @@ static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
[NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
[NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
[NFTA_EXTHDR_LEN] = { .type = NLA_U32 },
+ [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
};
static int nft_exthdr_init(const struct nft_ctx *ctx,
@@ -59,7 +65,7 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
{
struct nft_exthdr *priv = nft_expr_priv(expr);
- u32 offset, len;
+ u32 offset, len, flags = 0;
int err;
if (tb[NFTA_EXTHDR_DREG] == NULL ||
@@ -76,10 +82,20 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
if (err < 0)
return err;
+ if (tb[NFTA_EXTHDR_FLAGS]) {
+ err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
+ if (err < 0)
+ return err;
+
+ if (flags & ~NFT_EXTHDR_F_PRESENT)
+ return -EINVAL;
+ }
+
priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
priv->offset = offset;
priv->len = len;
priv->dreg = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
+ priv->flags = flags;
return nft_validate_register_store(ctx, priv->dreg, NULL,
NFT_DATA_VALUE, priv->len);
@@ -97,6 +113,8 @@ static int nft_exthdr_dump(struct sk_buff *skb, const struct nft_expr *expr)
goto nla_put_failure;
if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
goto nla_put_failure;
+ if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
+ goto nla_put_failure;
return 0;
nla_put_failure:
--
2.1.4
next prev parent reply other threads:[~2017-02-12 19:42 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-12 19:42 [PATCH 00/21] Netfilter updates for net-next Pablo Neira Ayuso
2017-02-12 19:42 ` Pablo Neira Ayuso [this message]
2017-02-12 19:42 ` [PATCH 02/21] netfilter: nf_tables: pass netns to set->ops->remove() Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 03/21] netfilter: nf_tables: use struct nft_set_iter in set element flush Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 04/21] netfilter: nf_tables: rename deactivate_one() to flush() Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 05/21] netfilter: nf_tables: add flush field to struct nft_set_iter Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 06/21] netfilter: nf_tables: rename struct nft_set_estimate class field Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 07/21] netfilter: nf_tables: add space notation to sets Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 08/21] netfilter: nf_tables: add bitmap set type Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 09/21] netfilter: nft_ct: add zone id get support Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 10/21] netfilter: nft_ct: prepare for key-dependent error unwind Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 11/21] netfilter: nft_ct: add zone id set support Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 12/21] netfilter: nft_exthdr: add TCP option matching Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 13/21] netfilter: nf_ct_sip: Use mod_timer_pending() Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 14/21] netfilter: nf_ct_expect: nf_ct_expect_insert() returns void Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 15/21] netfilter: nfnetlink: get rid of u_intX_t types Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 16/21] netfilter: nfnetlink: add nfnetlink_rcv_skb_batch() Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 17/21] netfilter: nfnetlink: allow to check for generation ID Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 18/21] netfilter: nf_tables: add check_genid to the nfnetlink subsystem Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 19/21] netfilter: nf_tables: add NFTA_RULE_ID attribute Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 20/21] netfilter: update MAINTAINERS Pablo Neira Ayuso
2017-02-12 19:42 ` [PATCH 21/21] netfilter: nf_tables: honor NFT_SET_OBJECT in set backend selection Pablo Neira Ayuso
2017-02-13 3:12 ` [PATCH 00/21] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1486928573-24773-2-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).