when using rule like
ip6 filter input tcp dport 22
nft generates:
[ payload load 1b @ network header + 6 => reg 1 ]
[ cmp eq reg 1 0x00000006 ]
[ payload load 2b @ transport header + 2 => reg 1 ]
[ cmp eq reg 1 0x00001600 ]
which is: ip6 filter input ip6 nexthdr tcp dport 22
IOW, such a rule won't match if e.g. a fragment header is in place.
This changes ip6_proto to use 'meta l4proto' which is the protocol header
found by exthdr walk.
A side effect is that for bridge we get a shorter dependency chain as it
no longer needs to prepend 'ether proto ipv6' for old 'ip6 nexthdr' dep.
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
src/proto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/proto.c b/src/proto.c
index fcdfbe73c735..3b20a5fd35b1 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -707,7 +707,6 @@ const struct proto_desc proto_icmp6 = {
const struct proto_desc proto_ip6 = {
.name = "ip6",
.base = PROTO_BASE_NETWORK_HDR,
- .protocol_key = IP6HDR_NEXTHDR,
.protocols = {
PROTO_LINK(IPPROTO_ESP, &proto_esp),
PROTO_LINK(IPPROTO_AH, &proto_ah),
@@ -720,6 +719,7 @@ const struct proto_desc proto_ip6 = {
PROTO_LINK(IPPROTO_ICMPV6, &proto_icmp6),
},
.templates = {
+ [0] = PROTO_META_TEMPLATE("l4proto", &inet_protocol_type, NFT_META_L4PROTO, 8),
[IP6HDR_VERSION] = HDR_BITFIELD("version", &integer_type, 0, 4),
[IP6HDR_DSCP] = HDR_BITFIELD("dscp", &dscp_type, 4, 6),
[IP6HDR_ECN] = HDR_BITFIELD("ecn", &ecn_type, 10, 2),
--
2.10.2
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
