src: add support for matching IPv4 options

Add capability to have rules matching IPv4 options. This is developed
mainly to support dropping of IP packets with loose and/or strict source
route route options.

Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 38f74e428fd31d4f3e52abe09bfefca06e018f61..5b1c380c03a5ae6f1cc66f192acf93c992c4e16b 100644 (file)
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -729,10 +729,12 @@ enum nft_exthdr_flags {
  *
  * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
  * @NFT_EXTHDR_OP_TCP: match against tcp options
+ * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
  */
 enum nft_exthdr_op {
        NFT_EXTHDR_OP_IPV6,
        NFT_EXTHDR_OP_TCPOPT,
+       NFT_EXTHDR_OP_IPV4,
        __NFT_EXTHDR_OP_MAX
 };
 #define NFT_EXTHDR_OP_MAX      (__NFT_EXTHDR_OP_MAX - 1)

diff --git a/src/expr/exthdr.c b/src/expr/exthdr.c
index bef453e06311f88febef52c12b4c0733325f280c..e5f714b07366f6ec45c419018a3d0001c16f1851 100644 (file)
--- a/src/expr/exthdr.c
+++ b/src/expr/exthdr.c
@@ -200,6 +200,9 @@ static const char *op2str(uint8_t op)
        case NFT_EXTHDR_OP_TCPOPT:
                return " tcpopt";
        case NFT_EXTHDR_OP_IPV6:
+               return " ipv6";
+       case NFT_EXTHDR_OP_IPV4:
+               return " ipv4";
        default:
                return "";
        }
@@ -209,6 +212,8 @@ static inline int str2exthdr_op(const char* str)
 {
        if (!strcmp(str, "tcpopt"))
                return NFT_EXTHDR_OP_TCPOPT;
+       if (!strcmp(str, "ipv4"))
+               return NFT_EXTHDR_OP_IPV4;
 
        /* if str == "ipv6" or anything else */
        return NFT_EXTHDR_OP_IPV6;