diff options
| author | Florian Westphal <fw@strlen.de> | 2019-06-18 20:43:59 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2019-06-19 22:52:45 +0200 |
| commit | fb5a36ad5c1032244cf76171648fdefbbe571519 (patch) | |
| tree | bf6972f5c6d3be9f5128a337daa649c227ab86c1 /tests/py/bridge/ether.t.payload | |
| parent | b65ea148d8f8edc4ef5774154b1aca25d884d500 (diff) | |
src: prefer meta protocol as bridge l3 dependency
On families other than 'ip', the rule
ip protocol icmp
needs a dependency on the ip protocol so we do not treat e.g. an ipv6
header as ip.
Bridge currently uses eth_hdr.type for this, but that will cause the
rule above to not match in case the ip packet is within a VLAN tagged
frame -- ether.type will appear as ETH_P_8021Q.
Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer
to use this instead.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/py/bridge/ether.t.payload')
| -rw-r--r-- | tests/py/bridge/ether.t.payload | 24 |
1 files changed, 16 insertions, 8 deletions
diff --git a/tests/py/bridge/ether.t.payload b/tests/py/bridge/ether.t.payload index 1caa2d50..eaff9c31 100644 --- a/tests/py/bridge/ether.t.payload +++ b/tests/py/bridge/ether.t.payload @@ -6,10 +6,12 @@ bridge test-bridge input [ cmp eq reg 1 0x00001600 ] [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] - [ payload load 8b @ link header + 6 => reg 1 ] - [ cmp eq reg 1 0x0c540f00 0x00080411 ] + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 16 => reg 1 ] [ cmp eq reg 1 0x04030201 ] + [ payload load 6b @ link header + 6 => reg 1 ] + [ cmp eq reg 1 0x0c540f00 0x00000411 ] [ immediate reg 0 accept ] # tcp dport 22 ip daddr 1.2.3.4 ether saddr 00:0f:54:0c:11:04 @@ -18,10 +20,12 @@ bridge test-bridge input [ cmp eq reg 1 0x00000006 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00001600 ] - [ payload load 8b @ link header + 6 => reg 1 ] - [ cmp eq reg 1 0x0c540f00 0x00080411 ] + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 16 => reg 1 ] [ cmp eq reg 1 0x04030201 ] + [ payload load 6b @ link header + 6 => reg 1 ] + [ cmp eq reg 1 0x0c540f00 0x00000411 ] # tcp dport 22 ether saddr 00:0f:54:0c:11:04 ip daddr 1.2.3.4 bridge test-bridge input @@ -29,15 +33,19 @@ bridge test-bridge input [ cmp eq reg 1 0x00000006 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00001600 ] - [ payload load 8b @ link header + 6 => reg 1 ] - [ cmp eq reg 1 0x0c540f00 0x00080411 ] + [ payload load 6b @ link header + 6 => reg 1 ] + [ cmp eq reg 1 0x0c540f00 0x00000411 ] + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 16 => reg 1 ] [ cmp eq reg 1 0x04030201 ] # ether saddr 00:0f:54:0c:11:04 ip daddr 1.2.3.4 accept bridge test-bridge input - [ payload load 8b @ link header + 6 => reg 1 ] - [ cmp eq reg 1 0x0c540f00 0x00080411 ] + [ payload load 6b @ link header + 6 => reg 1 ] + [ cmp eq reg 1 0x0c540f00 0x00000411 ] + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 16 => reg 1 ] [ cmp eq reg 1 0x04030201 ] [ immediate reg 0 accept ] |