[PATCH 27/30] netfilter: nf_tables: handle rt0 and rt2 properly

[Pablo Neira Ayuso]

From: Ahmed Abdelsalam <amsala...@gmail.com>

This fixes Netfilter's bugzilla #1219.

Type 0 and 2 of the IPv6 Routing extension header are not handled
properlyby exthdr_init_raw() in src/exthdr.c

In order to fix the bug, we extended the "enum nft_exthdr_op" to
differentiate between rt, rt0, and rt2.

In this patch we extended the kernel implementation of nf_tables to
recognize the new options

Signed-off-by: Ahmed Abdelsalam <amsala...@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
---
 include/uapi/linux/netfilter/nf_tables.h | 3 +++
 net/netfilter/nft_exthdr.c               | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/include/uapi/linux/netfilter/nf_tables.h 
b/include/uapi/linux/netfilter/nf_tables.h
index 66dceee0ae30..bb2135c8ad73 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -731,6 +731,9 @@ enum nft_exthdr_flags {
 enum nft_exthdr_op {
        NFT_EXTHDR_OP_IPV6,
        NFT_EXTHDR_OP_TCPOPT,
+       NFT_EXTHDR_OP_RT0,
+       NFT_EXTHDR_OP_RT2,
+       NFT_EXTHDR_OP_RT4,
        __NFT_EXTHDR_OP_MAX
 };
 #define NFT_EXTHDR_OP_MAX      (__NFT_EXTHDR_OP_MAX - 1)
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 47ec1046ad11..bbc1be2b3b73 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -399,6 +399,9 @@ nft_exthdr_select_ops(const struct nft_ctx *ctx,
                        return &nft_exthdr_tcp_ops;
                break;
        case NFT_EXTHDR_OP_IPV6:
+       case NFT_EXTHDR_OP_RT0:
+       case NFT_EXTHDR_OP_RT2:
+       case NFT_EXTHDR_OP_RT4:
                if (tb[NFTA_EXTHDR_DREG])
                        return &nft_exthdr_ipv6_ops;
                break;
-- 
2.11.0