nftables: how to parse optional packet header fields?

[James Chapman <jchapman@xxxxxxxxxxx>]

I'm working on adding L2TP support to nftables. L2TP has some optional
header fields which affect the offset of fields that nftables packet
filters need to match.

One possibility could be to define fixed header structures for all
possible L2TP field offset combinations and have the nft L2TP parser add
rules for all of the possible layout combinations when matching fields
which can be at a variable offset, i.e.

struct l2tpv2_hdr {
    uint16_t flags;
    uint16_t len;       /* present if L bit in flags is set */
    uint16_t tunnel_id;
    uint16_t session_id;
};

struct l2tpv2_nolen_hdr {
    uint16_t flags;
    uint16_t tunnel_id;
    uint16_t session_id;
};

L2TP users don't know or care if the L2TPv2 header includes the length
field, so it would be best not to expose this as a nft rule parameter.
Its presence is determined by a bit in the flags field of the header.

Is there a better way to handle packet header layouts where the field
offsets depend on other field values?

Thanks
James


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html