diff options
author | Florian Westphal <fw@strlen.de> | 2019-06-18 20:43:59 +0200 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2019-06-19 22:52:45 +0200 |
commit | fb5a36ad5c1032244cf76171648fdefbbe571519 (patch) | |
tree | bf6972f5c6d3be9f5128a337daa649c227ab86c1 /tests/py/inet | |
parent | b65ea148d8f8edc4ef5774154b1aca25d884d500 (diff) |
src: prefer meta protocol as bridge l3 dependency
On families other than 'ip', the rule
ip protocol icmp
needs a dependency on the ip protocol so we do not treat e.g. an ipv6
header as ip.
Bridge currently uses eth_hdr.type for this, but that will cause the
rule above to not match in case the ip packet is within a VLAN tagged
frame -- ether.type will appear as ETH_P_8021Q.
Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer
to use this instead.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/py/inet')
-rw-r--r-- | tests/py/inet/ip_tcp.t.payload.bridge | 8 | ||||
-rw-r--r-- | tests/py/inet/sets.t.payload.bridge | 4 |
2 files changed, 6 insertions, 6 deletions
diff --git a/tests/py/inet/ip_tcp.t.payload.bridge b/tests/py/inet/ip_tcp.t.payload.bridge index f9f2e0a1..0344cd66 100644 --- a/tests/py/inet/ip_tcp.t.payload.bridge +++ b/tests/py/inet/ip_tcp.t.payload.bridge @@ -1,6 +1,6 @@ # ip protocol tcp tcp dport 22 bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] @@ -9,7 +9,7 @@ bridge test-bridge input # ip protocol tcp ip saddr 1.2.3.4 tcp dport 22 bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] @@ -20,7 +20,7 @@ bridge test-bridge input # ip protocol tcp counter ip saddr 1.2.3.4 tcp dport 22 bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] @@ -32,7 +32,7 @@ bridge test-bridge input # ip protocol tcp counter tcp dport 22 bridge test-bridge input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] diff --git a/tests/py/inet/sets.t.payload.bridge b/tests/py/inet/sets.t.payload.bridge index 6f21f827..f5aaab1d 100644 --- a/tests/py/inet/sets.t.payload.bridge +++ b/tests/py/inet/sets.t.payload.bridge @@ -1,6 +1,6 @@ # ip saddr @set1 drop bridge test-inet input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 4b @ network header + 12 => reg 1 ] [ lookup reg 1 set set1 ] @@ -8,7 +8,7 @@ bridge test-inet input # ip6 daddr != @set2 accept bridge test-inet input - [ payload load 2b @ link header + 12 => reg 1 ] + [ meta load protocol => reg 1 ] [ cmp eq reg 1 0x0000dd86 ] [ payload load 16b @ network header + 24 => reg 1 ] [ lookup reg 1 set set2 0x1 ] |