summaryrefslogtreecommitdiffstats
path: root/src/meta.c
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2019-06-18 20:43:59 +0200
committerFlorian Westphal <fw@strlen.de>2019-06-19 22:52:45 +0200
commitfb5a36ad5c1032244cf76171648fdefbbe571519 (patch)
treebf6972f5c6d3be9f5128a337daa649c227ab86c1 /src/meta.c
parentb65ea148d8f8edc4ef5774154b1aca25d884d500 (diff)
src: prefer meta protocol as bridge l3 dependency
On families other than 'ip', the rule ip protocol icmp needs a dependency on the ip protocol so we do not treat e.g. an ipv6 header as ip. Bridge currently uses eth_hdr.type for this, but that will cause the rule above to not match in case the ip packet is within a VLAN tagged frame -- ether.type will appear as ETH_P_8021Q. Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer to use this instead. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/meta.c')
-rw-r--r--src/meta.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/src/meta.c b/src/meta.c
index 583e790f..1e8964eb 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -539,7 +539,11 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx,
proto_ctx_update(ctx, PROTO_BASE_TRANSPORT_HDR, &expr->location, desc);
break;
case NFT_META_PROTOCOL:
- if (h->base < PROTO_BASE_NETWORK_HDR && ctx->family != NFPROTO_NETDEV)
+ if (h->base != PROTO_BASE_LL_HDR)
+ return;
+
+ if (ctx->family != NFPROTO_NETDEV &&
+ ctx->family != NFPROTO_BRIDGE)
return;
desc = proto_find_upper(h->desc, ntohs(mpz_get_uint16(right->value)));