From 775e7ff1f5ddaa3208ea2c9178d9e5d8890d9739 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Thu, 24 Sep 2015 22:38:06 +0200 Subject: src: allow filtering on L2 header in inet family Error: conflicting protocols specified: inet vs. ether tcp dport 22 iiftype ether ether saddr 00:0f:54:0c:11:4 ^^^^^^^^^^^ This allows the implicit inet proto dependency to get replaced by an ethernet one. This is possible since by the time we detect the conflict the meta dependency for the network protocol has already been added. So we only need to add another dependency on the Linklayer frame type. Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=981 Acked-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal --- src/payload.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) (limited to 'src/payload.c') diff --git a/src/payload.c b/src/payload.c index 23afa2f2..b75527a1 100644 --- a/src/payload.c +++ b/src/payload.c @@ -183,13 +183,7 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr, "protocol specification is invalid " "for this family"); - left = meta_expr_alloc(&expr->location, NFT_META_IIFTYPE); - right = constant_expr_alloc(&expr->location, &arphrd_type, - BYTEORDER_HOST_ENDIAN, - 2 * BITS_PER_BYTE, &type); - - dep = relational_expr_alloc(&expr->location, OP_EQ, left, right); - stmt = expr_stmt_alloc(&dep->location, dep); + stmt = meta_stmt_meta_iiftype(&expr->location, type); if (stmt_evaluate(ctx, stmt) < 0) { return expr_error(ctx->msgs, expr, "dependency statement is invalid"); -- cgit v1.2.3