Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
96518518 PM |
2 | /* |
3 | * Copyright (c) 2008 Patrick McHardy <kaber@trash.net> | |
4 | * | |
96518518 PM |
5 | * Development of this code funded by Astaro AG (http://www.astaro.com/) |
6 | */ | |
7 | ||
99d1712b | 8 | #include <asm/unaligned.h> |
96518518 | 9 | #include <linux/kernel.h> |
96518518 PM |
10 | #include <linux/netlink.h> |
11 | #include <linux/netfilter.h> | |
12 | #include <linux/netfilter/nf_tables.h> | |
d0103158 | 13 | #include <net/netfilter/nf_tables_core.h> |
96518518 | 14 | #include <net/netfilter/nf_tables.h> |
935b7f64 | 15 | #include <net/tcp.h> |
96518518 PM |
16 | |
17 | struct nft_exthdr { | |
18 | u8 type; | |
19 | u8 offset; | |
20 | u8 len; | |
935b7f64 | 21 | u8 op; |
345023b0 | 22 | u8 dreg; |
4f16d25c | 23 | u8 sreg; |
c078ca3b | 24 | u8 flags; |
96518518 PM |
25 | }; |
26 | ||
935b7f64 MM |
27 | static unsigned int optlen(const u8 *opt, unsigned int offset) |
28 | { | |
29 | /* Beware zero-length options: make finite progress */ | |
30 | if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0) | |
31 | return 1; | |
32 | else | |
33 | return opt[offset + 1]; | |
34 | } | |
35 | ||
36 | static void nft_exthdr_ipv6_eval(const struct nft_expr *expr, | |
37 | struct nft_regs *regs, | |
38 | const struct nft_pktinfo *pkt) | |
96518518 PM |
39 | { |
40 | struct nft_exthdr *priv = nft_expr_priv(expr); | |
49499c3e | 41 | u32 *dest = ®s->data[priv->dreg]; |
540436c8 | 42 | unsigned int offset = 0; |
96518518 PM |
43 | int err; |
44 | ||
45 | err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); | |
c078ca3b | 46 | if (priv->flags & NFT_EXTHDR_F_PRESENT) { |
b4283366 | 47 | nft_reg_store8(dest, err >= 0); |
c078ca3b PS |
48 | return; |
49 | } else if (err < 0) { | |
96518518 | 50 | goto err; |
c078ca3b | 51 | } |
96518518 PM |
52 | offset += priv->offset; |
53 | ||
49499c3e | 54 | dest[priv->len / NFT_REG32_SIZE] = 0; |
fad136ea | 55 | if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0) |
96518518 PM |
56 | goto err; |
57 | return; | |
58 | err: | |
a55e22e9 | 59 | regs->verdict.code = NFT_BREAK; |
96518518 PM |
60 | } |
61 | ||
dbb5281a SS |
62 | /* find the offset to specified option. |
63 | * | |
64 | * If target header is found, its offset is set in *offset and return option | |
65 | * number. Otherwise, return negative error. | |
66 | * | |
67 | * If the first fragment doesn't contain the End of Options it is considered | |
68 | * invalid. | |
69 | */ | |
70 | static int ipv4_find_option(struct net *net, struct sk_buff *skb, | |
71 | unsigned int *offset, int target) | |
72 | { | |
73 | unsigned char optbuf[sizeof(struct ip_options) + 40]; | |
74 | struct ip_options *opt = (struct ip_options *)optbuf; | |
75 | struct iphdr *iph, _iph; | |
76 | unsigned int start; | |
77 | bool found = false; | |
78 | __be32 info; | |
79 | int optlen; | |
80 | ||
81 | iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); | |
82 | if (!iph) | |
83 | return -EBADMSG; | |
84 | start = sizeof(struct iphdr); | |
85 | ||
86 | optlen = iph->ihl * 4 - (int)sizeof(struct iphdr); | |
87 | if (optlen <= 0) | |
88 | return -ENOENT; | |
89 | ||
90 | memset(opt, 0, sizeof(struct ip_options)); | |
91 | /* Copy the options since __ip_options_compile() modifies | |
92 | * the options. | |
93 | */ | |
94 | if (skb_copy_bits(skb, start, opt->__data, optlen)) | |
95 | return -EBADMSG; | |
96 | opt->optlen = optlen; | |
97 | ||
98 | if (__ip_options_compile(net, opt, NULL, &info)) | |
99 | return -EBADMSG; | |
100 | ||
101 | switch (target) { | |
102 | case IPOPT_SSRR: | |
103 | case IPOPT_LSRR: | |
104 | if (!opt->srr) | |
105 | break; | |
106 | found = target == IPOPT_SSRR ? opt->is_strictroute : | |
107 | !opt->is_strictroute; | |
108 | if (found) | |
109 | *offset = opt->srr + start; | |
110 | break; | |
111 | case IPOPT_RR: | |
112 | if (!opt->rr) | |
113 | break; | |
114 | *offset = opt->rr + start; | |
115 | found = true; | |
116 | break; | |
117 | case IPOPT_RA: | |
118 | if (!opt->router_alert) | |
119 | break; | |
120 | *offset = opt->router_alert + start; | |
121 | found = true; | |
122 | break; | |
123 | default: | |
124 | return -EOPNOTSUPP; | |
125 | } | |
126 | return found ? target : -ENOENT; | |
127 | } | |
128 | ||
129 | static void nft_exthdr_ipv4_eval(const struct nft_expr *expr, | |
130 | struct nft_regs *regs, | |
131 | const struct nft_pktinfo *pkt) | |
132 | { | |
133 | struct nft_exthdr *priv = nft_expr_priv(expr); | |
134 | u32 *dest = ®s->data[priv->dreg]; | |
135 | struct sk_buff *skb = pkt->skb; | |
136 | unsigned int offset; | |
137 | int err; | |
138 | ||
139 | if (skb->protocol != htons(ETH_P_IP)) | |
140 | goto err; | |
141 | ||
142 | err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type); | |
143 | if (priv->flags & NFT_EXTHDR_F_PRESENT) { | |
b4283366 | 144 | nft_reg_store8(dest, err >= 0); |
dbb5281a SS |
145 | return; |
146 | } else if (err < 0) { | |
147 | goto err; | |
148 | } | |
149 | offset += priv->offset; | |
150 | ||
151 | dest[priv->len / NFT_REG32_SIZE] = 0; | |
152 | if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0) | |
153 | goto err; | |
154 | return; | |
155 | err: | |
156 | regs->verdict.code = NFT_BREAK; | |
157 | } | |
158 | ||
a1817700 FW |
159 | static void * |
160 | nft_tcp_header_pointer(const struct nft_pktinfo *pkt, | |
161 | unsigned int len, void *buffer, unsigned int *tcphdr_len) | |
162 | { | |
163 | struct tcphdr *tcph; | |
164 | ||
165 | if (!pkt->tprot_set || pkt->tprot != IPPROTO_TCP) | |
166 | return NULL; | |
167 | ||
168 | tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff, sizeof(*tcph), buffer); | |
169 | if (!tcph) | |
170 | return NULL; | |
171 | ||
172 | *tcphdr_len = __tcp_hdrlen(tcph); | |
173 | if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len) | |
174 | return NULL; | |
175 | ||
176 | return skb_header_pointer(pkt->skb, pkt->xt.thoff, *tcphdr_len, buffer); | |
177 | } | |
178 | ||
935b7f64 MM |
179 | static void nft_exthdr_tcp_eval(const struct nft_expr *expr, |
180 | struct nft_regs *regs, | |
181 | const struct nft_pktinfo *pkt) | |
182 | { | |
183 | u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE]; | |
184 | struct nft_exthdr *priv = nft_expr_priv(expr); | |
185 | unsigned int i, optl, tcphdr_len, offset; | |
186 | u32 *dest = ®s->data[priv->dreg]; | |
187 | struct tcphdr *tcph; | |
188 | u8 *opt; | |
189 | ||
a1817700 | 190 | tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); |
935b7f64 MM |
191 | if (!tcph) |
192 | goto err; | |
193 | ||
194 | opt = (u8 *)tcph; | |
195 | for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { | |
196 | optl = optlen(opt, i); | |
197 | ||
198 | if (priv->type != opt[i]) | |
199 | continue; | |
200 | ||
201 | if (i + optl > tcphdr_len || priv->len + priv->offset > optl) | |
202 | goto err; | |
203 | ||
204 | offset = i + priv->offset; | |
3c1fece8 PS |
205 | if (priv->flags & NFT_EXTHDR_F_PRESENT) { |
206 | *dest = 1; | |
207 | } else { | |
208 | dest[priv->len / NFT_REG32_SIZE] = 0; | |
209 | memcpy(dest, opt + offset, priv->len); | |
210 | } | |
935b7f64 MM |
211 | |
212 | return; | |
213 | } | |
214 | ||
215 | err: | |
3c1fece8 PS |
216 | if (priv->flags & NFT_EXTHDR_F_PRESENT) |
217 | *dest = 0; | |
218 | else | |
219 | regs->verdict.code = NFT_BREAK; | |
935b7f64 MM |
220 | } |
221 | ||
99d1712b FW |
222 | static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, |
223 | struct nft_regs *regs, | |
224 | const struct nft_pktinfo *pkt) | |
225 | { | |
226 | u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE]; | |
227 | struct nft_exthdr *priv = nft_expr_priv(expr); | |
228 | unsigned int i, optl, tcphdr_len, offset; | |
229 | struct tcphdr *tcph; | |
230 | u8 *opt; | |
99d1712b FW |
231 | |
232 | tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); | |
233 | if (!tcph) | |
234 | return; | |
235 | ||
236 | opt = (u8 *)tcph; | |
237 | for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { | |
238 | union { | |
99d1712b FW |
239 | __be16 v16; |
240 | __be32 v32; | |
241 | } old, new; | |
242 | ||
243 | optl = optlen(opt, i); | |
244 | ||
245 | if (priv->type != opt[i]) | |
246 | continue; | |
247 | ||
248 | if (i + optl > tcphdr_len || priv->len + priv->offset > optl) | |
249 | return; | |
250 | ||
7418ee4c FW |
251 | if (skb_ensure_writable(pkt->skb, |
252 | pkt->xt.thoff + i + priv->len)) | |
99d1712b FW |
253 | return; |
254 | ||
255 | tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, | |
256 | &tcphdr_len); | |
257 | if (!tcph) | |
258 | return; | |
259 | ||
99d1712b FW |
260 | offset = i + priv->offset; |
261 | ||
262 | switch (priv->len) { | |
263 | case 2: | |
264 | old.v16 = get_unaligned((u16 *)(opt + offset)); | |
2e34328b SM |
265 | new.v16 = (__force __be16)nft_reg_load16( |
266 | ®s->data[priv->sreg]); | |
99d1712b FW |
267 | |
268 | switch (priv->type) { | |
269 | case TCPOPT_MSS: | |
270 | /* increase can cause connection to stall */ | |
271 | if (ntohs(old.v16) <= ntohs(new.v16)) | |
272 | return; | |
273 | break; | |
274 | } | |
275 | ||
276 | if (old.v16 == new.v16) | |
277 | return; | |
278 | ||
279 | put_unaligned(new.v16, (u16*)(opt + offset)); | |
280 | inet_proto_csum_replace2(&tcph->check, pkt->skb, | |
281 | old.v16, new.v16, false); | |
282 | break; | |
283 | case 4: | |
2e34328b | 284 | new.v32 = regs->data[priv->sreg]; |
99d1712b FW |
285 | old.v32 = get_unaligned((u32 *)(opt + offset)); |
286 | ||
287 | if (old.v32 == new.v32) | |
288 | return; | |
289 | ||
290 | put_unaligned(new.v32, (u32*)(opt + offset)); | |
291 | inet_proto_csum_replace4(&tcph->check, pkt->skb, | |
292 | old.v32, new.v32, false); | |
293 | break; | |
294 | default: | |
295 | WARN_ON_ONCE(1); | |
296 | break; | |
297 | } | |
298 | ||
299 | return; | |
300 | } | |
301 | } | |
302 | ||
96518518 PM |
303 | static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = { |
304 | [NFTA_EXTHDR_DREG] = { .type = NLA_U32 }, | |
305 | [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 }, | |
306 | [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 }, | |
307 | [NFTA_EXTHDR_LEN] = { .type = NLA_U32 }, | |
c078ca3b | 308 | [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 }, |
f5b5702a FW |
309 | [NFTA_EXTHDR_OP] = { .type = NLA_U32 }, |
310 | [NFTA_EXTHDR_SREG] = { .type = NLA_U32 }, | |
96518518 PM |
311 | }; |
312 | ||
313 | static int nft_exthdr_init(const struct nft_ctx *ctx, | |
314 | const struct nft_expr *expr, | |
315 | const struct nlattr * const tb[]) | |
316 | { | |
317 | struct nft_exthdr *priv = nft_expr_priv(expr); | |
935b7f64 | 318 | u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6; |
21a9e0f1 | 319 | int err; |
96518518 | 320 | |
935b7f64 MM |
321 | if (!tb[NFTA_EXTHDR_DREG] || |
322 | !tb[NFTA_EXTHDR_TYPE] || | |
323 | !tb[NFTA_EXTHDR_OFFSET] || | |
324 | !tb[NFTA_EXTHDR_LEN]) | |
96518518 PM |
325 | return -EINVAL; |
326 | ||
36b701fa LGL |
327 | err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset); |
328 | if (err < 0) | |
329 | return err; | |
4da449ae | 330 | |
36b701fa LGL |
331 | err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len); |
332 | if (err < 0) | |
333 | return err; | |
4da449ae | 334 | |
c078ca3b PS |
335 | if (tb[NFTA_EXTHDR_FLAGS]) { |
336 | err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags); | |
337 | if (err < 0) | |
338 | return err; | |
339 | ||
340 | if (flags & ~NFT_EXTHDR_F_PRESENT) | |
341 | return -EINVAL; | |
342 | } | |
343 | ||
935b7f64 MM |
344 | if (tb[NFTA_EXTHDR_OP]) { |
345 | err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op); | |
346 | if (err < 0) | |
347 | return err; | |
348 | } | |
349 | ||
96518518 | 350 | priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); |
4da449ae LGL |
351 | priv->offset = offset; |
352 | priv->len = len; | |
c078ca3b | 353 | priv->flags = flags; |
935b7f64 | 354 | priv->op = op; |
96518518 | 355 | |
345023b0 PNA |
356 | return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG], |
357 | &priv->dreg, NULL, NFT_DATA_VALUE, | |
358 | priv->len); | |
96518518 PM |
359 | } |
360 | ||
99d1712b FW |
361 | static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx, |
362 | const struct nft_expr *expr, | |
363 | const struct nlattr * const tb[]) | |
364 | { | |
365 | struct nft_exthdr *priv = nft_expr_priv(expr); | |
366 | u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6; | |
367 | int err; | |
368 | ||
369 | if (!tb[NFTA_EXTHDR_SREG] || | |
370 | !tb[NFTA_EXTHDR_TYPE] || | |
371 | !tb[NFTA_EXTHDR_OFFSET] || | |
372 | !tb[NFTA_EXTHDR_LEN]) | |
373 | return -EINVAL; | |
374 | ||
375 | if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS]) | |
376 | return -EINVAL; | |
377 | ||
378 | err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset); | |
379 | if (err < 0) | |
380 | return err; | |
381 | ||
382 | err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len); | |
383 | if (err < 0) | |
384 | return err; | |
385 | ||
386 | if (offset < 2) | |
387 | return -EOPNOTSUPP; | |
388 | ||
389 | switch (len) { | |
390 | case 2: break; | |
391 | case 4: break; | |
392 | default: | |
393 | return -EOPNOTSUPP; | |
394 | } | |
395 | ||
396 | err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op); | |
397 | if (err < 0) | |
398 | return err; | |
399 | ||
400 | priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); | |
401 | priv->offset = offset; | |
402 | priv->len = len; | |
99d1712b FW |
403 | priv->flags = flags; |
404 | priv->op = op; | |
405 | ||
4f16d25c PNA |
406 | return nft_parse_register_load(tb[NFTA_EXTHDR_SREG], &priv->sreg, |
407 | priv->len); | |
99d1712b FW |
408 | } |
409 | ||
dbb5281a SS |
410 | static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx, |
411 | const struct nft_expr *expr, | |
412 | const struct nlattr * const tb[]) | |
413 | { | |
414 | struct nft_exthdr *priv = nft_expr_priv(expr); | |
415 | int err = nft_exthdr_init(ctx, expr, tb); | |
416 | ||
417 | if (err < 0) | |
418 | return err; | |
419 | ||
420 | switch (priv->type) { | |
421 | case IPOPT_SSRR: | |
422 | case IPOPT_LSRR: | |
423 | case IPOPT_RR: | |
424 | case IPOPT_RA: | |
425 | break; | |
426 | default: | |
427 | return -EOPNOTSUPP; | |
428 | } | |
429 | return 0; | |
430 | } | |
431 | ||
5e7d695a | 432 | static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv) |
96518518 | 433 | { |
96518518 PM |
434 | if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type)) |
435 | goto nla_put_failure; | |
436 | if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset))) | |
437 | goto nla_put_failure; | |
438 | if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len))) | |
439 | goto nla_put_failure; | |
c078ca3b PS |
440 | if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags))) |
441 | goto nla_put_failure; | |
935b7f64 MM |
442 | if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op))) |
443 | goto nla_put_failure; | |
96518518 PM |
444 | return 0; |
445 | ||
446 | nla_put_failure: | |
447 | return -1; | |
448 | } | |
449 | ||
5e7d695a FW |
450 | static int nft_exthdr_dump(struct sk_buff *skb, const struct nft_expr *expr) |
451 | { | |
452 | const struct nft_exthdr *priv = nft_expr_priv(expr); | |
453 | ||
454 | if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg)) | |
455 | return -1; | |
456 | ||
457 | return nft_exthdr_dump_common(skb, priv); | |
458 | } | |
459 | ||
99d1712b FW |
460 | static int nft_exthdr_dump_set(struct sk_buff *skb, const struct nft_expr *expr) |
461 | { | |
462 | const struct nft_exthdr *priv = nft_expr_priv(expr); | |
463 | ||
464 | if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg)) | |
465 | return -1; | |
466 | ||
467 | return nft_exthdr_dump_common(skb, priv); | |
468 | } | |
469 | ||
935b7f64 MM |
470 | static const struct nft_expr_ops nft_exthdr_ipv6_ops = { |
471 | .type = &nft_exthdr_type, | |
472 | .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), | |
473 | .eval = nft_exthdr_ipv6_eval, | |
474 | .init = nft_exthdr_init, | |
475 | .dump = nft_exthdr_dump, | |
476 | }; | |
477 | ||
dbb5281a SS |
478 | static const struct nft_expr_ops nft_exthdr_ipv4_ops = { |
479 | .type = &nft_exthdr_type, | |
480 | .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), | |
481 | .eval = nft_exthdr_ipv4_eval, | |
482 | .init = nft_exthdr_ipv4_init, | |
483 | .dump = nft_exthdr_dump, | |
484 | }; | |
485 | ||
935b7f64 | 486 | static const struct nft_expr_ops nft_exthdr_tcp_ops = { |
ef1f7df9 | 487 | .type = &nft_exthdr_type, |
96518518 | 488 | .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), |
935b7f64 | 489 | .eval = nft_exthdr_tcp_eval, |
96518518 PM |
490 | .init = nft_exthdr_init, |
491 | .dump = nft_exthdr_dump, | |
ef1f7df9 PM |
492 | }; |
493 | ||
99d1712b FW |
494 | static const struct nft_expr_ops nft_exthdr_tcp_set_ops = { |
495 | .type = &nft_exthdr_type, | |
496 | .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), | |
497 | .eval = nft_exthdr_tcp_set_eval, | |
498 | .init = nft_exthdr_tcp_set_init, | |
499 | .dump = nft_exthdr_dump_set, | |
500 | }; | |
501 | ||
935b7f64 MM |
502 | static const struct nft_expr_ops * |
503 | nft_exthdr_select_ops(const struct nft_ctx *ctx, | |
504 | const struct nlattr * const tb[]) | |
505 | { | |
506 | u32 op; | |
507 | ||
508 | if (!tb[NFTA_EXTHDR_OP]) | |
509 | return &nft_exthdr_ipv6_ops; | |
510 | ||
99d1712b FW |
511 | if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG]) |
512 | return ERR_PTR(-EOPNOTSUPP); | |
513 | ||
5fd02ebe | 514 | op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP])); |
935b7f64 MM |
515 | switch (op) { |
516 | case NFT_EXTHDR_OP_TCPOPT: | |
99d1712b FW |
517 | if (tb[NFTA_EXTHDR_SREG]) |
518 | return &nft_exthdr_tcp_set_ops; | |
519 | if (tb[NFTA_EXTHDR_DREG]) | |
520 | return &nft_exthdr_tcp_ops; | |
521 | break; | |
935b7f64 | 522 | case NFT_EXTHDR_OP_IPV6: |
99d1712b FW |
523 | if (tb[NFTA_EXTHDR_DREG]) |
524 | return &nft_exthdr_ipv6_ops; | |
525 | break; | |
dbb5281a SS |
526 | case NFT_EXTHDR_OP_IPV4: |
527 | if (ctx->family != NFPROTO_IPV6) { | |
528 | if (tb[NFTA_EXTHDR_DREG]) | |
529 | return &nft_exthdr_ipv4_ops; | |
530 | } | |
531 | break; | |
935b7f64 MM |
532 | } |
533 | ||
534 | return ERR_PTR(-EOPNOTSUPP); | |
535 | } | |
536 | ||
d0103158 | 537 | struct nft_expr_type nft_exthdr_type __read_mostly = { |
ef1f7df9 | 538 | .name = "exthdr", |
d4ef3835 | 539 | .select_ops = nft_exthdr_select_ops, |
96518518 PM |
540 | .policy = nft_exthdr_policy, |
541 | .maxattr = NFTA_EXTHDR_MAX, | |
ef1f7df9 | 542 | .owner = THIS_MODULE, |
96518518 | 543 | }; |