From aa0b8b03f7c7e741ccd96360bd64d90ea8c3c3aa Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 27 Sep 2022 23:19:34 +0200 Subject: ebtables: Support '-p Length' To match on Ethernet frames using the etherproto field as length value, ebtables accepts the special protocol name "LENGTH". Implement this in ebtables-nft using a native match for 'ether type < 0x0600'. Since extension 802_3 matches are valid only with such Ethernet frames, add a local add_match() wrapper which complains if the extension is used without '-p Length' parameter. Legacy ebtables does this within the extension's final_check callback, but it's not possible here due for lack of fw->bitmask field access. While being at it, add xlate support, adjust tests and make ebtables-nft print the case-insensitive argument with capital 'L' like legacy ebtables does. Signed-off-by: Phil Sutter --- extensions/generic.txlate | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'extensions/generic.txlate') diff --git a/extensions/generic.txlate b/extensions/generic.txlate index 9ae9a5b5..6779d6f8 100644 --- a/extensions/generic.txlate +++ b/extensions/generic.txlate @@ -67,6 +67,12 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00 nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter +ebtables-translate -I INPUT -p Length +nft insert rule bridge filter INPUT ether type < 0x0600 counter + +ebtables-translate -I INPUT -p ! Length +nft insert rule bridge filter INPUT ether type >= 0x0600 counter + # asterisk is not special in iptables and it is even a valid interface name iptables-translate -A FORWARD -i '*' -o 'eth*foo' nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter -- cgit v1.2.3