diff options
| author | Phil Sutter <phil@nwl.cc> | 2023-02-03 20:08:09 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2023-02-17 18:18:48 +0100 |
| commit | 267a26363826553280a5928043df30a07cdc63bb (patch) | |
| tree | 582938c6d930cabd17cbd261f75f7f5b1e16e755 /iptables | |
| parent | b860e658200af8fdeced2896a1a6c2f0f0692b70 (diff) | |
ebtables: ip and ip6 matches depend on protocol match
This is consistent with legacy ebtables, also avoids invalid
combinations like '-p IPv6 --ip-source 1.2.3.4'.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'iptables')
| -rw-r--r-- | iptables/nft-bridge.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index 83cbe315..b9983b20 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -104,11 +104,18 @@ static int nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, struct nftnl_rule *r, struct xt_entry_match *m) { - if (!strcmp(m->u.user.name, "802_3") && - !(fw->bitmask & EBT_802_3)) + if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3)) xtables_error(PARAMETER_PROBLEM, "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH"); + if (!strcmp(m->u.user.name, "ip") && fw->ethproto != htons(ETH_P_IP)) + xtables_error(PARAMETER_PROBLEM, + "For IP filtering the protocol must be specified as IPv4."); + + if (!strcmp(m->u.user.name, "ip6") && fw->ethproto != htons(ETH_P_IPV6)) + xtables_error(PARAMETER_PROBLEM, + "For IPv6 filtering the protocol must be specified as IPv6."); + return add_match(h, r, m); } |