This patch adds a bitwise operation to a rule
Signed-off-by: Giuseppe Longo <giuseppelng@xxxxxxxxx>
---
iptables/nft-arp.c | 9 +++++----
iptables/nft-ipv4.c | 10 ++++++----
iptables/nft-ipv6.c | 10 ++++++----
iptables/nft-shared.c | 13 +++++++++++--
iptables/nft-shared.h | 4 ++--
5 files changed, 30 insertions(+), 16 deletions(-)
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index bc25de3..c9dbee6 100644
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -202,8 +202,8 @@ static int nft_arp_add(struct nft_rule *r, void *data)
}
if (fw->arp.src.s_addr != 0)
- add_addr(r, sizeof(struct arphdr) + fw->arp.arhln,
- &fw->arp.src.s_addr, 4, flags);
+ add_addr(r, AF_INET, sizeof(struct arphdr) + fw->arp.arhln,
+ &fw->arp.src.s_addr, NULL, 4, flags);
if (fw->arp.tgt_devaddr.addr[0] != '\0') {
add_payload(r, sizeof(struct arphdr) + fw->arp.arhln + 4, fw->arp.arhln);
@@ -211,8 +211,9 @@ static int nft_arp_add(struct nft_rule *r, void *data)
}
if (fw->arp.tgt.s_addr != 0)
- add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
- &fw->arp.tgt.s_addr, 4, flags);
+ add_addr(r, AF_INET,
+ sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
+ &fw->arp.tgt.s_addr, NULL, 4, flags);
/* Counters need to me added before the target, otherwise they are
* increased for each rule because of the way nf_tables works.
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 70050ba..6e520b2 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -42,12 +42,14 @@ static int nft_ipv4_add(struct nft_rule *r, void *data)
cs->fw.ip.proto, cs->fw.ip.invflags);
if (cs->fw.ip.src.s_addr != 0)
- add_addr(r, offsetof(struct iphdr, saddr),
- &cs->fw.ip.src.s_addr, 4, cs->fw.ip.invflags);
+ add_addr(r, AF_INET, offsetof(struct iphdr, saddr),
+ &cs->fw.ip.src.s_addr, &cs->fw.ip.smsk.s_addr,
+ 4, cs->fw.ip.invflags);
if (cs->fw.ip.dst.s_addr != 0)
- add_addr(r, offsetof(struct iphdr, daddr),
- &cs->fw.ip.dst.s_addr, 4, cs->fw.ip.invflags);
+ add_addr(r, AF_INET, offsetof(struct iphdr, daddr),
+ &cs->fw.ip.dst.s_addr, &cs->fw.ip.dmsk.s_addr,
+ 4, cs->fw.ip.invflags);
if (cs->fw.ip.flags & IPT_F_FRAG) {
add_payload(r, offsetof(struct iphdr, frag_off), 2);
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 52de5b6..662c563 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -39,12 +39,14 @@ static int nft_ipv6_add(struct nft_rule *r, void *data)
cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags);
if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.src))
- add_addr(r, offsetof(struct ip6_hdr, ip6_src),
- &cs->fw6.ipv6.src, 16, cs->fw6.ipv6.invflags);
+ add_addr(r, AF_INET6, offsetof(struct ip6_hdr, ip6_src),
+ &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
+ 16, cs->fw6.ipv6.invflags);
if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.dst))
- add_addr(r, offsetof(struct ip6_hdr, ip6_dst),
- &cs->fw6.ipv6.dst, 16, cs->fw6.ipv6.invflags);
+ add_addr(r, AF_INET6, offsetof(struct ip6_hdr, ip6_dst),
+ &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
+ 16, cs->fw6.ipv6.invflags);
add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags);
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 3ffe877..2dcdfd1 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -184,8 +184,8 @@ void add_outiface(struct nft_rule *r, char *iface, int invflags)
add_cmp_ptr(r, op, iface, iface_len + 1);
}
-void add_addr(struct nft_rule *r, int offset,
- void *data, size_t len, int invflags)
+void add_addr(struct nft_rule *r, int family, int offset,
+ void *data, void *mask, size_t len, int invflags)
{
uint32_t op;
@@ -197,6 +197,15 @@ void add_addr(struct nft_rule *r, int offset,
op = NFT_CMP_EQ;
add_cmp_ptr(r, op, data, len);
+
+ if (family == AF_INET) {
+ uint32_t *msk = mask;
+ add_bitwise_u32(r, *msk, 0x00000000);
+ } else {
+ uint8_t mask6[16] = {0};
+ uint8_t xor[16] = {0};
+ add_bitwise_u128(r, mask6, xor);
+ }
}
void add_proto(struct nft_rule *r, int offset, size_t len,
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
index f2896bb..e5b6f1d 100644
--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
@@ -83,8 +83,8 @@ void add_cmp_u16(struct nft_rule *r, uint16_t val, uint32_t op);
void add_cmp_u32(struct nft_rule *r, uint32_t val, uint32_t op);
void add_iniface(struct nft_rule *r, char *iface, int invflags);
void add_outiface(struct nft_rule *r, char *iface, int invflags);
-void add_addr(struct nft_rule *r, int offset,
- void *data, size_t len, int invflags);
+void add_addr(struct nft_rule *r, int family, int offset,
+ void *data, void *mask, size_t len, int invflags);
void add_proto(struct nft_rule *r, int offset, size_t len,
uint8_t proto, int invflags);
void add_compat(struct nft_rule *r, uint32_t proto, bool inv);
--
1.8.3.2
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
