Add icmpv6 support.
PATCH 1/1 Add icmpv6 support.
This patch adds ICMPv6 support to nftables. It is now possible to write rules such as:
nft add rule ip6 filter input icmpv6 type nd-router-advert accept
Signed-off-by Eric Leblond <[email protected]>
--- include/datatype.h | 2 ++ include/payload.h | 14 +++++++++++++ src/parser.y | 34 ++++++++++++++++++++++++++++--- src/payload.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/scanner.l | 4 ++++ 5 files changed, 111 insertions(+), 3 deletions(-)
include/datatype.h +2 -0
@@ -32,6 +32,7 @@* @TYPE_CT_STATE: conntrack state (bitmask subtype) * @TYPE_CT_DIR: conntrack direction * @TYPE_CT_STATUS: conntrack status (bitmask subtype) +* @TYPE_ICMP6_TYPE: ICMPv6 type codes (integer subtype) */ enum datatypes {TYPE_INVALID ,
@@ -62,6 +63,7 @@ enum datatypes {TYPE_CT_STATE ,TYPE_CT_DIR ,TYPE_CT_STATUS , +TYPE_ICMP6_TYPE , __TYPE_MAX };#define TYPE_MAX (__TYPE_MAX - 1)
include/payload.h +14 -0
@@ -197,6 +197,18 @@ enum icmp_hdr_fields { ICMPHDR_MTU, }; +enum icmp6_hdr_fields { +ICMP6HDR_INVALID , +ICMP6HDR_TYPE , +ICMP6HDR_CODE , +ICMP6HDR_CHECKSUM , +ICMP6HDR_PPTR , +ICMP6HDR_MTU , +ICMP6HDR_ID , +ICMP6HDR_SEQ , +ICMP6HDR_MAXDELAY , +}; +enum ip6_hdr_fields {IP6HDR_INVALID ,IP6HDR_VERSION ,
@@ -207,6 +219,7 @@ enum ip6_hdr_fields {IP6HDR_HOPLIMIT ,IP6HDR_SADDR ,IP6HDR_DADDR , + IP6HDR_PROTOCOL, }; enum ah_hdr_fields {
@@ -278,6 +291,7 @@ extern const struct payload_desc payload_udplite;extern const struct payload_desc payload_tcp;extern const struct payload_desc payload_dccp;extern const struct payload_desc payload_sctp; +extern const struct payload_desc payload_icmp6;extern const struct payload_desc payload_ip;extern const struct payload_desc payload_ip6;
src/parser.y +31 -3
@@ -232,6 +232,11 @@ static void location_update(struct location *loc, struct location *rhs, int n) %token NEXTHDR "nexthdr" %token HOPLIMIT "hoplimit" +%token ICMP6 "icmpv6" +%token PPTR "param-problem" +%token MAXDELAY "max-delay" + + %token AH "ah" %token RESERVED "reserved" %token SPI "spi"
@@ -420,9 +425,9 @@ static void location_update(struct location *loc, struct location *rhs, int n) %type <expr> ip_hdr_expr icmp_hdr_expr %destructor { expr_free($$); } ip_hdr_expr icmp_hdr_expr %type <val> ip_hdr_field icmp_hdr_field -%type <expr> ip6_hdr_expr -%destructor { expr_free($$); } ip6_hdr_expr -%type <val> ip6_hdr_field +%type <expr> ip6_hdr_expr icmp6_hdr_expr +%destructor { expr_free($$); } ip6_hdr_expr icmp6_hdr_expr +%type <val> ip6_hdr_field icmp6_hdr_field %type <expr> auth_hdr_expr esp_hdr_expr comp_hdr_expr %destructor { expr_free($$); } auth_hdr_expr esp_hdr_expr comp_hdr_expr %type <val> auth_hdr_field esp_hdr_field comp_hdr_field
@@ -1337,6 +1342,7 @@ payload_expr : payload_raw_expr | ip_hdr_expr | icmp_hdr_expr | ip6_hdr_expr + | icmp6_hdr_expr | auth_hdr_expr | esp_hdr_expr | comp_hdr_expr
@@ -1454,6 +1460,28 @@ ip6_hdr_field : VERSION { $$ = IP6HDR_VERSION; } | SADDR { $$ = IP6HDR_SADDR; } | DADDR { $$ = IP6HDR_DADDR; } ; +icmp6_hdr_expr : ICMP6 icmp6_hdr_field + { + $$ = payload_expr_alloc(&@$, &payload_icmp6, $2); + } + | ICMP6 + { + uint8_t data = IPPROTO_ICMPV6; + $$ = constant_expr_alloc(&@$, &inet_protocol_type, + BYTEORDER_HOST_ENDIAN, + sizeof(data) * BITS_PER_BYTE, &data); + } + ; + +icmp6_hdr_field : TYPE { $$ = ICMP6HDR_TYPE; } + | CODE { $$ = ICMP6HDR_CODE; } + | CHECKSUM { $$ = ICMP6HDR_CHECKSUM; } + | PPTR { $$ = ICMP6HDR_PPTR; } + | MTU { $$ = ICMP6HDR_MTU; } + | ID { $$ = ICMP6HDR_ID; } + | SEQUENCE { $$ = ICMP6HDR_SEQ; } + | MAXDELAY { $$ = ICMP6HDR_MAXDELAY; } + ; auth_hdr_expr : AH auth_hdr_field {
src/payload.c +60 -0
76 lines not on this page · raw message
src/scanner.l +4 -0
@@ -323,6 +323,10 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "nexthdr" { return NEXTHDR; } "hoplimit" { return HOPLIMIT; } +"icmpv6" { return ICMP6; } +"param-problem" { return PPTR; } +"max-delay" { return MAXDELAY; } + "ah" { return AH; } "reserved" { return RESERVED; } "spi" { return SPI; }
Signature · 1 line
1.8.3.2
Quoted 3 lines · Eric Leblond
This patch adds ICMPv6 support to nftables. It is now possible to write rules such as:
nft add rule ip6 filter input icmpv6 type nd-router-advert accept
Applied, thanks Eric!