diff options
| author | Phil Sutter <phil@nwl.cc> | 2023-02-03 18:58:36 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2023-02-17 18:18:48 +0100 |
| commit | 744c56bda974caaa274318d2825b3e43b55bf145 (patch) | |
| tree | fbf1f0e0a25580a86abf915465d04a4241ca02d5 /extensions/libebt_ip.txlate | |
| parent | 6d1263002c2a9fc6dfa59c764dee767a084d428d (diff) | |
extensions: libebt_ip: Do not use 'ip dscp' for translation
Converting from TOS field match to DSCP one is irreversible, so replay
testing is not possible. Use a raw payload expression to produce
something that translates 1:1 back into an 'ip' match.
Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libebt_ip.txlate')
| -rw-r--r-- | extensions/libebt_ip.txlate | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate index 75c1db24..562e3157 100644 --- a/extensions/libebt_ip.txlate +++ b/extensions/libebt_ip.txlate @@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff -nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' +nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 nft 'add rule bridge filter FORWARD tcp dport 22 counter' |