|
 |
cf8614 |
From 267d86b62132a009badd57b2ffcffed6ae682a1e Mon Sep 17 00:00:00 2001
|
|
|
cf8614 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
cf8614 |
Date: Mon, 12 Jul 2021 17:44:08 +0200
|
|
|
cf8614 |
Subject: [PATCH] tcp: add raw tcp option match support
|
|
|
cf8614 |
|
|
|
cf8614 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1979334
|
|
|
cf8614 |
Upstream Status: nftables commit 881d8cb21c0b9
|
|
|
cf8614 |
|
|
|
cf8614 |
commit 881d8cb21c0b9168787b932f41b801593bde2216
|
|
|
cf8614 |
Author: Florian Westphal <fw@strlen.de>
|
|
|
cf8614 |
Date: Mon Nov 2 20:10:25 2020 +0100
|
|
|
cf8614 |
|
|
|
cf8614 |
tcp: add raw tcp option match support
|
|
|
cf8614 |
|
|
|
cf8614 |
tcp option @42,16,4 (@kind,offset,length).
|
|
|
cf8614 |
|
|
|
cf8614 |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
cf8614 |
---
|
|
|
cf8614 |
doc/payload-expression.txt | 6 ++++++
|
|
|
cf8614 |
src/exthdr.c | 13 +++++++++----
|
|
|
cf8614 |
src/parser_bison.y | 5 +++++
|
|
|
cf8614 |
src/tcpopt.c | 2 ++
|
|
|
cf8614 |
tests/py/any/tcpopt.t | 2 ++
|
|
|
cf8614 |
tests/py/any/tcpopt.t.payload | 7 +++++++
|
|
|
cf8614 |
6 files changed, 31 insertions(+), 4 deletions(-)
|
|
|
cf8614 |
|
|
|
cf8614 |
diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
|
|
|
cf8614 |
index 3a07321..b6d2a28 100644
|
|
|
cf8614 |
--- a/doc/payload-expression.txt
|
|
|
cf8614 |
+++ b/doc/payload-expression.txt
|
|
|
cf8614 |
@@ -591,6 +591,12 @@ TCP Timestamps |
|
|
|
cf8614 |
kind, length, tsval, tsecr
|
|
|
cf8614 |
|============================
|
|
|
cf8614 |
|
|
|
cf8614 |
+TCP option matching also supports raw expression syntax to access arbitrary options:
|
|
|
cf8614 |
+[verse]
|
|
|
cf8614 |
+*tcp option*
|
|
|
cf8614 |
+[verse]
|
|
|
cf8614 |
+*tcp option* *@*'number'*,*'offset'*,*'length'
|
|
|
cf8614 |
+
|
|
|
cf8614 |
.IP Options
|
|
|
cf8614 |
[options="header"]
|
|
|
cf8614 |
|==================
|
|
|
cf8614 |
diff --git a/src/exthdr.c b/src/exthdr.c
|
|
|
cf8614 |
index 68d5aa5..5c75720 100644
|
|
|
cf8614 |
--- a/src/exthdr.c
|
|
|
cf8614 |
+++ b/src/exthdr.c
|
|
|
cf8614 |
@@ -32,10 +32,15 @@ static void exthdr_expr_print(const struct expr *expr, struct output_ctx *octx)
|
|
|
cf8614 |
*/
|
|
|
cf8614 |
unsigned int offset = expr->exthdr.offset / 64;
|
|
|
cf8614 |
|
|
|
cf8614 |
- if (expr->exthdr.desc == NULL &&
|
|
|
cf8614 |
- expr->exthdr.offset == 0 &&
|
|
|
cf8614 |
- expr->exthdr.flags & NFT_EXTHDR_F_PRESENT) {
|
|
|
cf8614 |
- nft_print(octx, "tcp option %d", expr->exthdr.raw_type);
|
|
|
cf8614 |
+ if (expr->exthdr.desc == NULL) {
|
|
|
cf8614 |
+ if (expr->exthdr.offset == 0 &&
|
|
|
cf8614 |
+ expr->exthdr.flags & NFT_EXTHDR_F_PRESENT) {
|
|
|
cf8614 |
+ nft_print(octx, "tcp option %d", expr->exthdr.raw_type);
|
|
|
cf8614 |
+ return;
|
|
|
cf8614 |
+ }
|
|
|
cf8614 |
+
|
|
|
cf8614 |
+ nft_print(octx, "tcp option @%u,%u,%u", expr->exthdr.raw_type,
|
|
|
cf8614 |
+ expr->exthdr.offset, expr->len);
|
|
|
cf8614 |
return;
|
|
|
cf8614 |
}
|
|
|
cf8614 |
|
|
|
cf8614 |
diff --git a/src/parser_bison.y b/src/parser_bison.y
|
|
|
cf8614 |
index 4ea9364..5aedc55 100644
|
|
|
cf8614 |
--- a/src/parser_bison.y
|
|
|
cf8614 |
+++ b/src/parser_bison.y
|
|
|
cf8614 |
@@ -4718,6 +4718,11 @@ tcp_hdr_expr : TCP tcp_hdr_field
|
|
|
cf8614 |
$$ = tcpopt_expr_alloc(&@$, $3, TCPOPT_COMMON_KIND);
|
|
|
cf8614 |
$$->exthdr.flags = NFT_EXTHDR_F_PRESENT;
|
|
|
cf8614 |
}
|
|
|
cf8614 |
+ | TCP OPTION AT tcp_hdr_option_type COMMA NUM COMMA NUM
|
|
|
cf8614 |
+ {
|
|
|
cf8614 |
+ $$ = tcpopt_expr_alloc(&@$, $4, 0);
|
|
|
cf8614 |
+ tcpopt_init_raw($$, $4, $6, $8, 0);
|
|
|
cf8614 |
+ }
|
|
|
cf8614 |
;
|
|
|
cf8614 |
|
|
|
cf8614 |
tcp_hdr_field : SPORT { $$ = TCPHDR_SPORT; }
|
|
|
cf8614 |
diff --git a/src/tcpopt.c b/src/tcpopt.c
|
|
|
cf8614 |
index 1cf97a5..05b5ee6 100644
|
|
|
cf8614 |
--- a/src/tcpopt.c
|
|
|
cf8614 |
+++ b/src/tcpopt.c
|
|
|
cf8614 |
@@ -197,6 +197,8 @@ void tcpopt_init_raw(struct expr *expr, uint8_t type, unsigned int off,
|
|
|
cf8614 |
|
|
|
cf8614 |
if (flags & NFT_EXTHDR_F_PRESENT)
|
|
|
cf8614 |
datatype_set(expr, &boolean_type);
|
|
|
cf8614 |
+ else
|
|
|
cf8614 |
+ datatype_set(expr, &integer_type);
|
|
|
cf8614 |
|
|
|
cf8614 |
if (type >= array_size(tcpopt_protocols))
|
|
|
cf8614 |
return;
|
|
|
cf8614 |
diff --git a/tests/py/any/tcpopt.t b/tests/py/any/tcpopt.t
|
|
|
cf8614 |
index 7b17014..e759ac6 100644
|
|
|
cf8614 |
--- a/tests/py/any/tcpopt.t
|
|
|
cf8614 |
+++ b/tests/py/any/tcpopt.t
|
|
|
cf8614 |
@@ -31,6 +31,7 @@ tcp option timestamp length 1;ok
|
|
|
cf8614 |
tcp option timestamp tsval 1;ok
|
|
|
cf8614 |
tcp option timestamp tsecr 1;ok
|
|
|
cf8614 |
tcp option 255 missing;ok
|
|
|
cf8614 |
+tcp option @255,8,8 255;ok
|
|
|
cf8614 |
|
|
|
cf8614 |
tcp option foobar;fail
|
|
|
cf8614 |
tcp option foo bar;fail
|
|
|
cf8614 |
@@ -40,6 +41,7 @@ tcp option eol left 1;fail
|
|
|
cf8614 |
tcp option sack window;fail
|
|
|
cf8614 |
tcp option sack window 1;fail
|
|
|
cf8614 |
tcp option 256 exists;fail
|
|
|
cf8614 |
+tcp option @255,8,8 256;fail
|
|
|
cf8614 |
|
|
|
cf8614 |
tcp option window exists;ok
|
|
|
cf8614 |
tcp option window missing;ok
|
|
|
cf8614 |
diff --git a/tests/py/any/tcpopt.t.payload b/tests/py/any/tcpopt.t.payload
|
|
|
cf8614 |
index 34f8e26..cddba61 100644
|
|
|
cf8614 |
--- a/tests/py/any/tcpopt.t.payload
|
|
|
cf8614 |
+++ b/tests/py/any/tcpopt.t.payload
|
|
|
cf8614 |
@@ -523,6 +523,13 @@ inet
|
|
|
cf8614 |
[ exthdr load tcpopt 1b @ 255 + 0 present => reg 1 ]
|
|
|
cf8614 |
[ cmp eq reg 1 0x00000000 ]
|
|
|
cf8614 |
|
|
|
cf8614 |
+# tcp option @255,8,8 255
|
|
|
cf8614 |
+inet
|
|
|
cf8614 |
+ [ meta load l4proto => reg 1 ]
|
|
|
cf8614 |
+ [ cmp eq reg 1 0x00000006 ]
|
|
|
cf8614 |
+ [ exthdr load tcpopt 1b @ 255 + 1 => reg 1 ]
|
|
|
cf8614 |
+ [ cmp eq reg 1 0x000000ff ]
|
|
|
cf8614 |
+
|
|
|
cf8614 |
# tcp option window exists
|
|
|
cf8614 |
inet
|
|
|
cf8614 |
[ meta load l4proto => reg 1 ]
|
|
|
cf8614 |
--
|
|
|
cf8614 |
2.31.1
|
|
|
cf8614 |
|