diff options
| author | Phil Sutter <phil@nwl.cc> | 2023-02-03 17:37:40 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2023-02-17 18:18:48 +0100 |
| commit | b860e658200af8fdeced2896a1a6c2f0f0692b70 (patch) | |
| tree | 146f8d8c9cf7c5c57afe827ab6b8214e9e161b8b /extensions/libebt_ip.txlate | |
| parent | 744c56bda974caaa274318d2825b3e43b55bf145 (diff) | |
extensions: libebt_ip: Translation has to match on ether type
On one hand, nft refuses th expression in bridge family if layer3
protocol has not been assured by a previous match. On the other, ebt_ip
kernel module will only match on IPv4 packets, so there might be a
functional change in the translation versus the original.
Instead of just always emitting an 'ether type' match, decide whether
it's actually needed - explicit "ip <something>" payload matches (or
icmp ones) cause implicit creation of a match on IPv4 by nft.
Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libebt_ip.txlate')
| -rw-r--r-- | extensions/libebt_ip.txlate | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate index 562e3157..28996832 100644 --- a/extensions/libebt_ip.txlate +++ b/extensions/libebt_ip.txlate @@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff -nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' +nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 -nft 'add rule bridge filter FORWARD tcp dport 22 counter' +nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 -nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' +nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' ebtables-translate -A FORWARD -p ip --ip-proto 253 nft 'add rule bridge filter FORWARD ip protocol 253 counter' |