From 8a0a3dbd208e0559bcce9008accfe38c7143183c Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 27 Sep 2022 14:16:15 +0200 Subject: evaluate: add ethernet header size offset for implicit vlan dependency 'vlan id 1' must also add a ethernet header dep, else nft fetches the payload from header offset 0 instead of 14. Reported-by: Yi Chen Signed-off-by: Florian Westphal --- src/evaluate.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) (limited to 'src/evaluate.c') diff --git a/src/evaluate.c b/src/evaluate.c index ca6e5883..a52867b3 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -723,7 +723,25 @@ static int __expr_evaluate_payload(struct eval_ctx *ctx, struct expr *expr) rule_stmt_insert_at(ctx->rule, nstmt, ctx->stmt); desc = ctx->pctx.protocol[base].desc; - goto check_icmp; + + if (desc == expr->payload.desc) + goto check_icmp; + + if (base == PROTO_BASE_LL_HDR) { + int link; + + link = proto_find_num(desc, payload->payload.desc); + if (link < 0 || + conflict_resolution_gen_dependency(ctx, link, payload, &nstmt) < 0) + return expr_error(ctx->msgs, payload, + "conflicting protocols specified: %s vs. %s", + desc->name, + payload->payload.desc->name); + + payload->payload.offset += ctx->pctx.stacked_ll[0]->length; + rule_stmt_insert_at(ctx->rule, nstmt, ctx->stmt); + return 1; + } } if (payload->payload.base == desc->base && -- cgit v1.2.3