diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/meta.c | 6 | ||||
| -rw-r--r-- | src/payload.c | 18 |
2 files changed, 23 insertions, 1 deletions
@@ -539,7 +539,11 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx, proto_ctx_update(ctx, PROTO_BASE_TRANSPORT_HDR, &expr->location, desc); break; case NFT_META_PROTOCOL: - if (h->base < PROTO_BASE_NETWORK_HDR && ctx->family != NFPROTO_NETDEV) + if (h->base != PROTO_BASE_LL_HDR) + return; + + if (ctx->family != NFPROTO_NETDEV && + ctx->family != NFPROTO_BRIDGE) return; desc = proto_find_upper(h->desc, ntohs(mpz_get_uint16(right->value))); diff --git a/src/payload.c b/src/payload.c index 338a4b76..7e4f935b 100644 --- a/src/payload.c +++ b/src/payload.c @@ -18,6 +18,7 @@ #include <net/if_arp.h> #include <arpa/inet.h> #include <linux/netfilter.h> +#include <linux/if_ether.h> #include <rule.h> #include <expression.h> @@ -369,6 +370,23 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr, "no %s protocol specified", proto_base_names[expr->payload.base - 1]); + if (ctx->pctx.family == NFPROTO_BRIDGE && desc == &proto_eth) { + /* prefer netdev proto, which adds dependencies based + * on skb->protocol. + * + * This has the advantage that we will also match + * vlan encapsulated traffic. + * + * eth_hdr(skb)->type would not match, as nft_payload + * will pretend vlan tag was not offloaded, i.e. + * type is ETH_P_8021Q in such a case, but skb->protocol + * would still match the l3 header type. + */ + if (expr->payload.desc == &proto_ip || + expr->payload.desc == &proto_ip6) + desc = &proto_netdev; + } + return payload_add_dependency(ctx, desc, expr->payload.desc, expr, res); } |