Re: [PATCH nft] proto: fix VLAN header definition

[Florian Westphal <fw@strlen.de>]

Patrick McHardy <kaber@trash.net> wrote:
> On 27.11, Florian Westphal wrote:
> > Patrick McHardy <kaber@trash.net> wrote:
> > > The VID is located after Priority and CFI.
> > 
> > With this patch matching on vlan id does not work for me anymore
> > on x86-64.
> > 
> > With trace-patch nft but without this patch:
> > 
> > table bridge filter {
> > chain input {
> >    type filter hook input priority -200; policy accept;
> >    vlan id 4094 counter packets 827 bytes 63839
> > 
> > With this patch, the counters remain at zero:
> > 
> > unknown unknown & 0xfff [invalid type] == 0xffe [invalid type] counter packets 850 bytes 65375
> > vlan id 4094 counter packets 0 bytes 0
> > 
> > (The 'unknown unknown' line is the 'old' vlan rule added by unpatched
> >  nft binary, the 'vlan id' is the one added with the patched one).
> 
> Odd, since it decodes correctly. Could you send the output of
> nft --debug=netlink with and without the patch?

master:
nft --debug=netlink  add rule  bridge filter input vlan id 4094 counter
bridge filter input
 [ payload load 2b @ link header + 12 => reg 1 ]
 [ cmp eq reg 1 0x00000081 ]
 [ payload load 2b @ link header + 14 => reg 1 ]
 [ bitwise reg 1 = (reg=1 & 0x0000ff0f ) ^ 0x00000000 ]
 [ cmp eq reg 1 0x0000fe0f ]
 [ counter pkts 0 bytes 0 ]

patched:
# src/nft --debug=netlink  add rule  bridge filter input vlan id 4094 counter
bridge filter input
 [ payload load 2b @ link header + 12 => reg 1 ]
 [ cmp eq reg 1 0x00000081 ]
 [ payload load 2b @ link header + 14 => reg 1 ]
 [ bitwise reg 1 = (reg=1 & 0x0000f0ff ) ^ 0x00000000 ]
 [ cmp eq reg 1 0x0000e0ff ]
 [ counter pkts 0 bytes 0 ]