]> git.ipfire.org Git - thirdparty/nftables.git/commit
src: fix routing header support
authorFlorian Westphal <fw@strlen.de>
Fri, 16 Mar 2018 16:39:29 +0000 (17:39 +0100)
committerFlorian Westphal <fw@strlen.de>
Fri, 16 Mar 2018 23:06:25 +0000 (00:06 +0100)
commit9642a79381793daedc1d58b3ac4c3c61a2ec38f1
tree43ff83214e0fe1ef6c8004c6073022f0c486d82d
parentca7253263a0158cafd609d924809232b562131b2
src: fix routing header support

We can't use nft_exthdr_op to encode routing header, it breaks
ipv6 extension header support.

When encountering RT header, userspace did now set a new ipv6 exthdr mode,
but old kernel doesn't know about this, so this failed with -EOPNOTSUPP.

Revert that part and use NFT_EXTHDR_OP_IPV6.
When decoding a routing extension header, try the various route
types until we find a match.

Note this patch isn't complete:

'srh tag 127' creates following expressions:
  [ exthdr load 2b @ 43 + 6 => reg 1 ]
  [ cmp eq reg 1 0x00007f00 ]

It should instead insert a dependency test ("rt type 4"):
  [ exthdr load 1b @ 43 + 2 => reg 1 ]
  [ cmp eq reg 1 0x00000004 ]
  [ exthdr load 2b @ 43 + 6 => reg 1 ]
  [ cmp eq reg 1 0x00007e00 ]

nft should then use this to infer the routing header type.

While add it, document the srh option.

Fixes: 1400288f6d39d ("src: handle rt0 and rt2 properly")
Reported-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Ahmed Abdelsalam <amsalam20@gmail.com>
doc/nft.xml
include/linux/netfilter/nf_tables.h
src/exthdr.c