From fb5a36ad5c1032244cf76171648fdefbbe571519 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 18 Jun 2019 20:43:59 +0200 Subject: src: prefer meta protocol as bridge l3 dependency On families other than 'ip', the rule ip protocol icmp needs a dependency on the ip protocol so we do not treat e.g. an ipv6 header as ip. Bridge currently uses eth_hdr.type for this, but that will cause the rule above to not match in case the ip packet is within a VLAN tagged frame -- ether.type will appear as ETH_P_8021Q. Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer to use this instead. Signed-off-by: Florian Westphal Acked-by: Pablo Neira Ayuso --- src/payload.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'src/payload.c') diff --git a/src/payload.c b/src/payload.c index 338a4b76..7e4f935b 100644 --- a/src/payload.c +++ b/src/payload.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include @@ -369,6 +370,23 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr, "no %s protocol specified", proto_base_names[expr->payload.base - 1]); + if (ctx->pctx.family == NFPROTO_BRIDGE && desc == &proto_eth) { + /* prefer netdev proto, which adds dependencies based + * on skb->protocol. + * + * This has the advantage that we will also match + * vlan encapsulated traffic. + * + * eth_hdr(skb)->type would not match, as nft_payload + * will pretend vlan tag was not offloaded, i.e. + * type is ETH_P_8021Q in such a case, but skb->protocol + * would still match the l3 header type. + */ + if (expr->payload.desc == &proto_ip || + expr->payload.desc == &proto_ip6) + desc = &proto_netdev; + } + return payload_add_dependency(ctx, desc, expr->payload.desc, expr, res); } -- cgit v1.2.3