src: ipv6: switch implicit dependencies to meta l4proto

when using rule like

ip6 filter input tcp dport 22
nft generates:
  [ payload load 1b @ network header + 6 => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ payload load 2b @ transport header + 2 => reg 1 ]
  [ cmp eq reg 1 0x00001600 ]

which is: ip6 filter input ip6 nexthdr tcp dport 22
IOW, such a rule won't match if e.g. a fragment header is in place.

This changes ip6_proto to use 'meta l4proto' which is the protocol header
found by exthdr walk.

A side effect is that for bridge we get a shorter dependency chain as it
no longer needs to prepend 'ether proto ipv6' for old 'ip6 nexthdr' dep.

Only problem:

ip6 nexthdr tcp tcp dport 22
will now inject a (useless) meta l4 dependency as ip6 nexthdr is no
longer flagged as EXPR_F_PROTOCOL, to avoid this add a small helper
that skips the unneded meta dependency in that case.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/payload.c b/src/payload.c
index 31e5a0244837076ee6c40c6c1eff35da65f9b017..38db15ee2664f1a18bcfd4eb1c4ff8a4112d283a 100644 (file)
--- a/src/payload.c
+++ b/src/payload.c
@@ -117,6 +117,23 @@ static const struct expr_ops payload_expr_ops = {
        .pctx_update    = payload_expr_pctx_update,
 };
 
+/*
+ * ipv6 is special case, we normally use 'meta l4proto' to fetch the last
+ * l4 header of the ipv6 extension header chain so we will also match
+ * tcp after a fragmentation header, for instance.
+ *
+ * If user specifically asks for nexthdr x, treat is as a full
+ * dependency rather than injecting another (useless) meta l4 one.
+ */
+static bool proto_key_is_protocol(const struct proto_desc *desc, unsigned int type)
+{
+       if (type == desc->protocol_key ||
+           (desc == &proto_ip6 && type == IP6HDR_NEXTHDR))
+               return true;
+
+       return false;
+}
+
 struct expr *payload_expr_alloc(const struct location *loc,
                                const struct proto_desc *desc,
                                unsigned int type)
@@ -129,7 +146,7 @@ struct expr *payload_expr_alloc(const struct location *loc,
        if (desc != NULL) {
                tmpl = &desc->templates[type];
                base = desc->base;
-               if (type == desc->protocol_key)
+               if (proto_key_is_protocol(desc, type))
                        flags = EXPR_F_PROTOCOL;
        } else {
                tmpl = &proto_unknown_template;

diff --git a/src/proto.c b/src/proto.c
index fcdfbe73c735fd4c9464c09e32ce989af9035ccd..3b20a5fd35b17f938430941a025f29f19027b909 100644 (file)
--- a/src/proto.c
+++ b/src/proto.c
@@ -707,7 +707,6 @@ const struct proto_desc proto_icmp6 = {
 const struct proto_desc proto_ip6 = {
        .name           = "ip6",
        .base           = PROTO_BASE_NETWORK_HDR,
-       .protocol_key   = IP6HDR_NEXTHDR,
        .protocols      = {
                PROTO_LINK(IPPROTO_ESP,         &proto_esp),
                PROTO_LINK(IPPROTO_AH,          &proto_ah),
@@ -720,6 +719,7 @@ const struct proto_desc proto_ip6 = {
                PROTO_LINK(IPPROTO_ICMPV6,      &proto_icmp6),
        },
        .templates      = {
+               [0]     = PROTO_META_TEMPLATE("l4proto", &inet_protocol_type, NFT_META_L4PROTO, 8),
                [IP6HDR_VERSION]        = HDR_BITFIELD("version", &integer_type, 0, 4),
                [IP6HDR_DSCP]           = HDR_BITFIELD("dscp", &dscp_type, 4, 6),
                [IP6HDR_ECN]            = HDR_BITFIELD("ecn", &ecn_type, 10, 2),