From fb5a36ad5c1032244cf76171648fdefbbe571519 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 18 Jun 2019 20:43:59 +0200 Subject: src: prefer meta protocol as bridge l3 dependency On families other than 'ip', the rule ip protocol icmp needs a dependency on the ip protocol so we do not treat e.g. an ipv6 header as ip. Bridge currently uses eth_hdr.type for this, but that will cause the rule above to not match in case the ip packet is within a VLAN tagged frame -- ether.type will appear as ETH_P_8021Q. Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer to use this instead. Signed-off-by: Florian Westphal Acked-by: Pablo Neira Ayuso --- src/meta.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'src/meta.c') diff --git a/src/meta.c b/src/meta.c index 583e790f..1e8964eb 100644 --- a/src/meta.c +++ b/src/meta.c @@ -539,7 +539,11 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx, proto_ctx_update(ctx, PROTO_BASE_TRANSPORT_HDR, &expr->location, desc); break; case NFT_META_PROTOCOL: - if (h->base < PROTO_BASE_NETWORK_HDR && ctx->family != NFPROTO_NETDEV) + if (h->base != PROTO_BASE_LL_HDR) + return; + + if (ctx->family != NFPROTO_NETDEV && + ctx->family != NFPROTO_BRIDGE) return; desc = proto_find_upper(h->desc, ntohs(mpz_get_uint16(right->value))); -- cgit v1.2.3