summaryrefslogtreecommitdiffstats
path: root/src/payload.c
diff options
context:
space:
mode:
authorM. Braun <michael-dev@fami-braun.de>2019-07-15 18:59:01 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2019-07-31 14:44:46 +0200
commit88849ff15acaada4b0b76870ca48268236c6f30a (patch)
treeb771f7d7f3483f4d3d9a32dcb5b074b7124865b1 /src/payload.c
parenta79f5b729ede4fe39386f2c4971064083631fa7a (diff)
src: Fix dumping vlan rules
Given the following bridge rules: 1. ip protocol icmp accept 2. ether type vlan vlan type ip ip protocol icmp accept The are currently both dumped by "nft list ruleset" as 1. ip protocol icmp accept 2. ip protocol icmp accept Though, the netlink code actually is different bridge filter FORWARD 4 [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ immediate reg 0 accept ] bridge filter FORWARD 5 4 [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000081 ] [ payload load 2b @ link header + 16 => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ immediate reg 0 accept ] What happens here is that: 1. vlan type ip kills ether type vlan 2. ip protocol icmp kills vlan type ip Fix this by avoiding the removal of all vlan statements in the given example. Signed-off-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/payload.c')
-rw-r--r--src/payload.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/src/payload.c b/src/payload.c
index abd5339c..3576400b 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -529,6 +529,18 @@ static bool payload_may_dependency_kill(struct payload_dep_ctx *ctx,
dep->left->payload.desc == &proto_ip6) &&
expr->payload.base == PROTO_BASE_TRANSPORT_HDR)
return false;
+ /* Do not kill
+ * ether type vlan and vlan type ip and ip protocol icmp
+ * into
+ * ip protocol icmp
+ * as this lacks ether type vlan.
+ * More generally speaking, do not kill protocol type
+ * for stacked protocols if we only have protcol type matches.
+ */
+ if (dep->left->etype == EXPR_PAYLOAD && dep->op == OP_EQ &&
+ expr->flags & EXPR_F_PROTOCOL &&
+ expr->payload.base == dep->left->payload.base)
+ return false;
break;
}