From fb5a36ad5c1032244cf76171648fdefbbe571519 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 18 Jun 2019 20:43:59 +0200 Subject: src: prefer meta protocol as bridge l3 dependency On families other than 'ip', the rule ip protocol icmp needs a dependency on the ip protocol so we do not treat e.g. an ipv6 header as ip. Bridge currently uses eth_hdr.type for this, but that will cause the rule above to not match in case the ip packet is within a VLAN tagged frame -- ether.type will appear as ETH_P_8021Q. Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer to use this instead. Signed-off-by: Florian Westphal Acked-by: Pablo Neira Ayuso --- tests/py/bridge/ether.t | 4 ++-- tests/py/bridge/ether.t.payload | 24 ++++++++++++++++-------- tests/py/bridge/icmpX.t.payload | 4 ++-- tests/py/bridge/reject.t.payload | 24 ++++++++++++------------ 4 files changed, 32 insertions(+), 24 deletions(-) (limited to 'tests/py/bridge') diff --git a/tests/py/bridge/ether.t b/tests/py/bridge/ether.t index 15f5f857..e4f75d16 100644 --- a/tests/py/bridge/ether.t +++ b/tests/py/bridge/ether.t @@ -2,8 +2,8 @@ *bridge;test-bridge;input -tcp dport 22 iiftype ether ip daddr 1.2.3.4 ether saddr 00:0f:54:0c:11:4 accept;ok;tcp dport 22 ether saddr 00:0f:54:0c:11:04 ip daddr 1.2.3.4 accept -tcp dport 22 ip daddr 1.2.3.4 ether saddr 00:0f:54:0c:11:04;ok;tcp dport 22 ether saddr 00:0f:54:0c:11:04 ip daddr 1.2.3.4 +tcp dport 22 iiftype ether ip daddr 1.2.3.4 ether saddr 00:0f:54:0c:11:4 accept;ok;tcp dport 22 ip daddr 1.2.3.4 ether saddr 00:0f:54:0c:11:04 accept +tcp dport 22 ip daddr 1.2.3.4 ether saddr 00:0f:54:0c:11:04;ok tcp dport 22 ether saddr 00:0f:54:0c:11:04 ip daddr 1.2.3.4;ok ether saddr 00:0f:54:0c:11:04 ip daddr 1.2.3.4 accept;ok diff --git a/tests/py/bridge/ether.t.payload b/tests/py/bridge/ether.t.payload index 1caa2d50..eaff9c31 100644 --- a/tests/py/bridge/ether.t.payload +++ b/tests/py/bridge/ether.t.payload @@ -6,10 +6,12 @@ bridge test-bridge input [ cmp eq reg 1 0x00001600 ] [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] - [ payload load 8b @ link header + 6 => reg 1 ] - [ cmp eq reg 1 0x0c540f00 0x00080411 ] + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 16 => reg 1 ] [ cmp eq reg 1 0x04030201 ] + [ payload load 6b @ link header + 6 => reg 1 ] + [ cmp eq reg 1 0x0c540f00 0x00000411 ] [ immediate reg 0 accept ] # tcp dport 22 ip daddr 1.2.3.4 ether saddr 00:0f:54:0c:11:04 @@ -18,10 +20,12 @@ bridge test-bridge input [ cmp eq reg 1 0x00000006 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00001600 ] - [ payload load 8b @ link header + 6 => reg 1 ] - [ cmp eq reg 1 0x0c540f00 0x00080411 ] + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 16 => reg 1 ] [ cmp eq reg 1 0x04030201 ] + [ payload load 6b @ link header + 6 => reg 1 ] + [ cmp eq reg 1 0x0c540f00 0x00000411 ] # tcp dport 22 ether saddr 00:0f:54:0c:11:04 ip daddr 1.2.3.4 bridge test-bridge input @@ -29,15 +33,19 @@ bridge test-bridge input [ cmp eq reg 1 0x00000006 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00001600 ] - [ payload load 8b @ link header + 6 => reg 1 ] - [ cmp eq reg 1 0x0c540f00 0x00080411 ] + [ payload load 6b @ link header + 6 => reg 1 ] + [ cmp eq reg 1 0x0c540f00 0x00000411 ] + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 16 => reg 1 ] [ cmp eq reg 1 0x04030201 ] # ether saddr 00:0f:54:0c:11:04 ip daddr 1.2.3.4 accept bridge test-bridge input - [ payload load 8b @ link header + 6 => reg 1 ] - [ cmp eq reg 1 0x0c540f00 0x00080411 ] + [ payload load 6b @ link header + 6 => reg 1 ] + [ cmp eq reg 1 0x0c540f00 0x00000411 ] + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 16 => reg 1 ] [ cmp eq reg 1 0x04030201 ] [ immediate reg 0 accept ] diff --git a/tests/py/bridge/icmpX.t.payload b/tests/py/bridge/icmpX.t.payload index 0fab1abf..f9ea7b60 100644 --- a/tests/py/bridge/icmpX.t.payload +++ b/tests/py/bridge/icmpX.t.payload @@ -1,6 +1,6 @@ # ip protocol icmp icmp type echo-request bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000001 ] @@ -18,7 +18,7 @@ bridge test-bridge input # ip6 nexthdr icmpv6 icmpv6 type echo-request bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x0000dd86 ] [ payload load 1b @ network header + 6 => reg 1 ] [ cmp eq reg 1 0x0000003a ] diff --git a/tests/py/bridge/reject.t.payload b/tests/py/bridge/reject.t.payload index 888179df..0d10547b 100644 --- a/tests/py/bridge/reject.t.payload +++ b/tests/py/bridge/reject.t.payload @@ -1,66 +1,66 @@ # reject with icmp type host-unreachable bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 1 ] # reject with icmp type net-unreachable bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 0 ] # reject with icmp type prot-unreachable bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 2 ] # reject with icmp type port-unreachable bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 3 ] # reject with icmp type net-prohibited bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 9 ] # reject with icmp type host-prohibited bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 10 ] # reject with icmp type admin-prohibited bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 13 ] # reject with icmpv6 type no-route bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x0000dd86 ] [ reject type 0 code 0 ] # reject with icmpv6 type admin-prohibited bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x0000dd86 ] [ reject type 0 code 1 ] # reject with icmpv6 type addr-unreachable bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x0000dd86 ] [ reject type 0 code 3 ] # reject with icmpv6 type port-unreachable bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x0000dd86 ] [ reject type 0 code 4 ] @@ -68,7 +68,7 @@ bridge test-bridge input bridge test-bridge input [ meta load mark => reg 1 ] [ cmp eq reg 1 0x00003039 ] - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] -- cgit v1.2.3