[PATCH nft] payload: fix transport matching with no network layer info in bridge family

[PATCH nft] payload: fix transport matching with no network layer info in bridge family

[Pablo Neira Ayuso]

 # nft --debug=netlink add rule bridge filter input tcp dport 22
 bridge filter input
  [ meta load l4proto => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ payload load 2b @ transport header + 2 => reg 1 ]
  [ cmp eq reg 1 0x00001600 ]

Reported-by: Eric Leblond <eric@regit.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/payload.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/payload.c b/src/payload.c
index 08578fd..e67ef17 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -219,6 +219,9 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
 			case PROTO_BASE_LL_HDR:
 				desc = &proto_eth;
 				break;
+			case PROTO_BASE_TRANSPORT_HDR:
+				desc = &proto_inet_service;
+				break;
 			default:
 				break;
 			}
-- 
1.7.10.4

Re: [PATCH nft] payload: fix transport matching with no network layer info in bridge family

[Patrick McHardy]

On 26.06, Pablo Neira Ayuso wrote:
>  # nft --debug=netlink add rule bridge filter input tcp dport 22
>  bridge filter input
>   [ meta load l4proto => reg 1 ]
>   [ cmp eq reg 1 0x00000006 ]
>   [ payload load 2b @ transport header + 2 => reg 1 ]
>   [ cmp eq reg 1 0x00001600 ]
> 
> Reported-by: Eric Leblond <eric@regit.org>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  src/payload.c |    3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/src/payload.c b/src/payload.c
> index 08578fd..e67ef17 100644
> --- a/src/payload.c
> +++ b/src/payload.c
> @@ -219,6 +219,9 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
>  			case PROTO_BASE_LL_HDR:
>  				desc = &proto_eth;
>  				break;
> +			case PROTO_BASE_TRANSPORT_HDR:
> +				desc = &proto_inet_service;
> +				break;

Just a very minor issue - the switch statement for NFPROTO_INET
just above uses the opposite ordering. Would increase readbility
to use the same for both, and I actually LL then TRANSPORT.

>  			default:
>  				break;
>  			}
> -- 
> 1.7.10.4
> 

[PATCH nft] payload: reorder case in a switch for consistency

[Eric Leblond]

As pointed out by Patrick McHardy the order in the inet switch
in payload_gen_dependency was not consistent.

Signed-off-by: Eric Leblond <eric@regit.org>
---
 src/payload.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/payload.c b/src/payload.c
index e67ef17..5f8c4fe 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -204,12 +204,12 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
 		switch (ctx->pctx.family) {
 		case NFPROTO_INET:
 			switch (expr->payload.base) {
-			case PROTO_BASE_TRANSPORT_HDR:
-				desc = &proto_inet_service;
-				break;
 			case PROTO_BASE_LL_HDR:
 				desc = &proto_inet;
 				break;
+			case PROTO_BASE_TRANSPORT_HDR:
+				desc = &proto_inet_service;
+				break;
 			default:
 				break;
 			}
-- 
2.1.4

Re: [PATCH nft] payload: reorder case in a switch for consistency

[Pablo Neira Ayuso]

On Fri, Jun 26, 2015 at 11:55:21AM +0200, Eric Leblond wrote:
> As pointed out by Patrick McHardy the order in the inet switch
> in payload_gen_dependency was not consistent.

Applied, thanks.