proto: fix icmp/icmpv6 code datatype

Andrew A. Sabitov says:
  I'd like to use a set (concatenation) of icmpv6 type and icmpv6 code
  and check incoming icmpv6 traffic against it:

  add set inet fw in_icmpv6_types { type icmpv6_type . icmpv6_code; }
  add element inet fw in_icmpv6_types { 1 . 0 } # no route to destination
  add element inet fw in_icmpv6_types { 1 . 1 } # communication with destination administratively prohibited
  # ...

 add rule inet fw in_icmpv6 icmpv6 type . icmpv6 code @in_icmpv6_types \
   limit rate 15/minute accept

yields:
Error: can not use variable sized data types (integer) in concat expressions
        icmpv6 type . icmpv6 code @in_icmpv6_types
         ~~~~~~~~~~~~~~^^^^^^^^^^^

Change 'code' type to the icmp/icmpv6 code type.
Needs minor change to test suite as nft will now display
human-readable names instead of numeric codes.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1276
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/proto.c b/src/proto.c
index ed011efab22294ba6920e855b49b0db9e064f433..d178bf39ea9079225f35a668039236616caa7759 100644 (file)
--- a/src/proto.c
+++ b/src/proto.c
@@ -347,7 +347,7 @@ const struct proto_desc proto_icmp = {
        .checksum_key   = ICMPHDR_CHECKSUM,
        .templates      = {
                [ICMPHDR_TYPE]          = ICMPHDR_TYPE("type", &icmp_type_type, type),
-               [ICMPHDR_CODE]          = ICMPHDR_FIELD("code", code),
+               [ICMPHDR_CODE]          = ICMPHDR_TYPE("code", &icmp_code_type, code),
                [ICMPHDR_CHECKSUM]      = ICMPHDR_FIELD("checksum", checksum),
                [ICMPHDR_ID]            = ICMPHDR_FIELD("id", un.echo.id),
                [ICMPHDR_SEQ]           = ICMPHDR_FIELD("sequence", un.echo.sequence),
@@ -686,7 +686,7 @@ const struct proto_desc proto_icmp6 = {
        .checksum_key   = ICMP6HDR_CHECKSUM,
        .templates      = {
                [ICMP6HDR_TYPE]         = ICMP6HDR_TYPE("type", &icmp6_type_type, icmp6_type),
-               [ICMP6HDR_CODE]         = ICMP6HDR_FIELD("code", icmp6_code),
+               [ICMP6HDR_CODE]         = ICMP6HDR_TYPE("code", &icmpv6_code_type, icmp6_code),
                [ICMP6HDR_CHECKSUM]     = ICMP6HDR_FIELD("checksum", icmp6_cksum),
                [ICMP6HDR_PPTR]         = ICMP6HDR_FIELD("parameter-problem", icmp6_pptr),
                [ICMP6HDR_MTU]          = ICMP6HDR_FIELD("mtu", icmp6_mtu),

diff --git a/tests/py/ip/icmp.t b/tests/py/ip/icmp.t
index 5a7ce7e08bac07ab83b099f29b1ae0660ad7deba..6c05fb9d0fbca05fb9545fa3c3a5b13445bbb9d4 100644 (file)
--- a/tests/py/ip/icmp.t
+++ b/tests/py/ip/icmp.t
@@ -28,8 +28,8 @@ icmp code 33-55;ok
 icmp code != 33-55;ok
 icmp code { 33-55};ok
 icmp code != { 33-55};ok
-icmp code { 2, 4, 54, 33, 56};ok
-icmp code != { 2, 4, 54, 33, 56};ok
+icmp code { 2, 4, 54, 33, 56};ok;icmp code { prot-unreachable, 4, 33, 54, 56}
+icmp code != { prot-unreachable, 4, 33, 54, 56};ok
 
 icmp checksum 12343 accept;ok
 icmp checksum != 12343 accept;ok

diff --git a/tests/py/ip/icmp.t.payload.ip b/tests/py/ip/icmp.t.payload.ip
index f959cf338295c750222232c3837de419cb37a8fa..27f222072d5dcace723494327a4c04e5bb92eaba 100644 (file)
--- a/tests/py/ip/icmp.t.payload.ip
+++ b/tests/py/ip/icmp.t.payload.ip
@@ -184,7 +184,7 @@ ip test-ip4 input
   [ payload load 1b @ transport header + 1 => reg 1 ]
   [ lookup reg 1 set __set%d ]
 
-# icmp code != { 2, 4, 54, 33, 56}
+# icmp code != { prot-unreachable, 4, 33, 54, 56}
 __set%d test-ip4 3
 __set%d test-ip4 0
        element 00000002  : 0 [end]     element 00000004  : 0 [end]     element 00000036  : 0 [end]     element 00000021  : 0 [end]     element 00000038  : 0 [end]

diff --git a/tests/py/ip6/icmpv6.t b/tests/py/ip6/icmpv6.t
index a898fe30c24c75e63cd2bbeb9cf04c7c9c0fe904..8d794115d51e98d029ab73db55da9ded5dd21535 100644 (file)
--- a/tests/py/ip6/icmpv6.t
+++ b/tests/py/ip6/icmpv6.t
@@ -28,10 +28,10 @@ icmpv6 type {router-renumbering, mld-listener-done, time-exceeded, nd-router-sol
 icmpv6 type {mld-listener-query, time-exceeded, nd-router-advert} accept;ok
 icmpv6 type != {mld-listener-query, time-exceeded, nd-router-advert} accept;ok
 
-icmpv6 code 4;ok
+icmpv6 code 4;ok;icmpv6 code port-unreachable
 icmpv6 code 3-66;ok
-icmpv6 code {5, 6, 7} accept;ok
-icmpv6 code != {5, 6, 7} accept;ok
+icmpv6 code {5, 6, 7} accept;ok;icmpv6 code {policy-fail, reject-route, 7} accept
+icmpv6 code != {policy-fail, reject-route, 7} accept;ok
 icmpv6 code { 3-66};ok
 icmpv6 code != { 3-66};ok
 

diff --git a/tests/py/ip6/icmpv6.t.payload.ip6 b/tests/py/ip6/icmpv6.t.payload.ip6
index 7a630f9f8b097d33013433cdc615a2482f4ac572..51d71f4149b568e957b44b7e1f2d8ed64df9ba68 100644 (file)
--- a/tests/py/ip6/icmpv6.t.payload.ip6
+++ b/tests/py/ip6/icmpv6.t.payload.ip6
@@ -220,7 +220,7 @@ ip6 test-ip6 input
   [ lookup reg 1 set __set%d ]
   [ immediate reg 0 accept ]
 
-# icmpv6 code != {5, 6, 7} accept
+# icmpv6 code != {policy-fail, reject-route, 7} accept
 __set%d test-ip6 3
 __set%d test-ip6 0
        element 00000005  : 0 [end]     element 00000006  : 0 [end]     element 00000007  : 0 [end]