diff options
author | M. Braun <michael-dev@fami-braun.de> | 2019-07-15 18:59:01 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-07-31 14:44:46 +0200 |
commit | 88849ff15acaada4b0b76870ca48268236c6f30a (patch) | |
tree | b771f7d7f3483f4d3d9a32dcb5b074b7124865b1 /tests/py/bridge/vlan.t.payload | |
parent | a79f5b729ede4fe39386f2c4971064083631fa7a (diff) |
src: Fix dumping vlan rules
Given the following bridge rules:
1. ip protocol icmp accept
2. ether type vlan vlan type ip ip protocol icmp accept
The are currently both dumped by "nft list ruleset" as
1. ip protocol icmp accept
2. ip protocol icmp accept
Though, the netlink code actually is different
bridge filter FORWARD 4
[ payload load 2b @ link header + 12 => reg 1 ]
[ cmp eq reg 1 0x00000008 ]
[ payload load 1b @ network header + 9 => reg 1 ]
[ cmp eq reg 1 0x00000001 ]
[ immediate reg 0 accept ]
bridge filter FORWARD 5 4
[ payload load 2b @ link header + 12 => reg 1 ]
[ cmp eq reg 1 0x00000081 ]
[ payload load 2b @ link header + 16 => reg 1 ]
[ cmp eq reg 1 0x00000008 ]
[ payload load 1b @ network header + 9 => reg 1 ]
[ cmp eq reg 1 0x00000001 ]
[ immediate reg 0 accept ]
What happens here is that:
1. vlan type ip kills ether type vlan
2. ip protocol icmp kills vlan type ip
Fix this by avoiding the removal of all vlan statements
in the given example.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/py/bridge/vlan.t.payload')
-rw-r--r-- | tests/py/bridge/vlan.t.payload | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/tests/py/bridge/vlan.t.payload b/tests/py/bridge/vlan.t.payload index cb0e812f..bb8925e3 100644 --- a/tests/py/bridge/vlan.t.payload +++ b/tests/py/bridge/vlan.t.payload @@ -199,3 +199,13 @@ bridge test-bridge input [ cmp gte reg 1 0x00000020 ] [ cmp lte reg 1 0x00000060 ] +# ether type vlan ip protocol 1 accept +bridge test-bridge input + [ payload load 2b @ link header + 12 => reg 1 ] + [ cmp eq reg 1 0x00000081 ] + [ payload load 2b @ link header + 16 => reg 1 ] + [ cmp eq reg 1 0x00000008 ] + [ payload load 1b @ network header + 9 => reg 1 ] + [ cmp eq reg 1 0x00000001 ] + [ immediate reg 0 accept ] + |