netlink_delinearize: incorrect meta protocol dependency kill

meta protocol is meaningful in bridge, netdev and inet families, do
not remove this.

Fixes: 056aaa3e6dc6 ("netlink_delinearize: Refactor meta_may_dependency_kill()")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 5b545701e8b70bfa679c6c1a9715fbed08de44ea..92617a46df6f2d73479305cf4e30253ba135a21f 100644 (file)
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -1993,7 +1993,7 @@ static bool meta_may_dependency_kill(struct payload_dep_ctx *ctx,
                                     const struct expr *expr)
 {
        struct expr *dep = ctx->pdep->expr;
-       uint16_t l3proto;
+       uint16_t l3proto, protocol;
        uint8_t l4proto;
 
        if (ctx->pbase != PROTO_BASE_NETWORK_HDR)
@@ -2005,7 +2005,22 @@ static bool meta_may_dependency_kill(struct payload_dep_ctx *ctx,
        case NFPROTO_BRIDGE:
                break;
        default:
-               return true;
+               if (dep->left->etype != EXPR_META ||
+                   dep->right->etype != EXPR_VALUE)
+                       return false;
+
+               if (dep->left->meta.key == NFT_META_PROTOCOL) {
+                       protocol = mpz_get_uint16(dep->right->value);
+
+                       if (family == NFPROTO_IPV4 &&
+                           protocol == ETH_P_IP)
+                               return true;
+                       else if (family == NFPROTO_IPV6 &&
+                                protocol == ETH_P_IPV6)
+                               return true;
+               }
+
+               return false;
        }
 
        if (expr->left->meta.key != NFT_META_L4PROTO)
@@ -2015,7 +2030,8 @@ static bool meta_may_dependency_kill(struct payload_dep_ctx *ctx,
 
        switch (dep->left->etype) {
        case EXPR_META:
-               if (dep->left->meta.key != NFT_META_NFPROTO)
+               if (dep->left->meta.key != NFT_META_NFPROTO &&
+                   dep->left->meta.key != NFT_META_PROTOCOL)
                        return true;
                break;
        case EXPR_PAYLOAD:

diff --git a/tests/py/bridge/meta.t b/tests/py/bridge/meta.t
index eda7082f02b4a3c91281187253ba9045772257ba..d77ebd899f1859ecd2f0e097c9257500c6303671 100644 (file)
--- a/tests/py/bridge/meta.t
+++ b/tests/py/bridge/meta.t
@@ -6,3 +6,6 @@ meta obrname "br0";ok
 meta ibrname "br0";ok
 meta ibrvproto vlan;ok;meta ibrvproto 8021q
 meta ibrpvid 100;ok
+
+meta protocol ip udp dport 67;ok
+meta protocol ip6 udp dport 67;ok

diff --git a/tests/py/bridge/meta.t.json b/tests/py/bridge/meta.t.json
index 3122774eba8c2b2874aaa3626d482515c9dbd968..d7dc9d7b5ea7fe4326993e444c109cb6433ba2ca 100644 (file)
--- a/tests/py/bridge/meta.t.json
+++ b/tests/py/bridge/meta.t.json
@@ -49,3 +49,57 @@
         }
     }
 ]
+
+# meta protocol ip udp dport 67
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "protocol"
+                }
+            },
+            "op": "==",
+            "right": "ip"
+        }
+    },
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 67
+        }
+    }
+]
+
+# meta protocol ip6 udp dport 67
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "protocol"
+                }
+            },
+            "op": "==",
+            "right": "ip6"
+        }
+    },
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 67
+        }
+    }
+]

diff --git a/tests/py/bridge/meta.t.payload b/tests/py/bridge/meta.t.payload
index aa8c994bfe58ff6b2e2013fd7bed473354b2a97b..0a39842aedf3edf7b3bab95d574ecbe0d37013c2 100644 (file)
--- a/tests/py/bridge/meta.t.payload
+++ b/tests/py/bridge/meta.t.payload
@@ -17,3 +17,21 @@ bridge test-bridge input
 bridge test-bridge input
   [ meta load bri_iifpvid => reg 1 ]
   [ cmp eq reg 1 0x00000064 ]
+
+# meta protocol ip udp dport 67
+bridge test-bridge input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000011 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00004300 ]
+
+# meta protocol ip6 udp dport 67
+bridge test-bridge input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x0000dd86 ]
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000011 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00004300 ]

diff --git a/tests/py/inet/meta.t b/tests/py/inet/meta.t
index 3638898b5dbb4e5fd247408f9999fad49a419087..423cc5f32cba4a6d7ce604e696a9c51df8ef5565 100644 (file)
--- a/tests/py/inet/meta.t
+++ b/tests/py/inet/meta.t
@@ -12,6 +12,10 @@ meta nfproto ipv4 tcp dport 22;ok
 meta nfproto ipv4 ip saddr 1.2.3.4;ok;ip saddr 1.2.3.4
 meta nfproto ipv6 meta l4proto tcp;ok;meta nfproto ipv6 meta l4proto 6
 meta nfproto ipv4 counter ip saddr 1.2.3.4;ok
+
+meta protocol ip udp dport 67;ok
+meta protocol ip6 udp dport 67;ok
+
 meta ipsec exists;ok
 meta secpath missing;ok;meta ipsec missing
 meta ibrname "br0";fail

diff --git a/tests/py/inet/meta.t.json b/tests/py/inet/meta.t.json
index 5c0e7d2e0e4293dc937379d5df127e4b143f4d2e..723a36f74946e6cbed8db1ec90a850c1a1924ea1 100644 (file)
--- a/tests/py/inet/meta.t.json
+++ b/tests/py/inet/meta.t.json
@@ -235,3 +235,57 @@
         }
     }
 ]
+
+# meta protocol ip udp dport 67
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "protocol"
+                }
+            },
+            "op": "==",
+            "right": "ip"
+        }
+    },
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 67
+        }
+    }
+]
+
+# meta protocol ip6 udp dport 67
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "protocol"
+                }
+            },
+            "op": "==",
+            "right": "ip6"
+        }
+    },
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 67
+        }
+    }
+]

diff --git a/tests/py/inet/meta.t.payload b/tests/py/inet/meta.t.payload
index 6ccf6d24210aba4e05b8f44dff44580e66d6e015..fd0545490b78be6bdf4403471aae221095898f1e 100644 (file)
--- a/tests/py/inet/meta.t.payload
+++ b/tests/py/inet/meta.t.payload
@@ -79,3 +79,21 @@ inet test-inet input
   [ ct load mark => reg 1 ]
   [ bitwise reg 1 = ( reg 1 >> 0x00000008 ) ]
   [ meta set mark with reg 1 ]
+
+# meta protocol ip udp dport 67
+inet test-inet input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000011 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00004300 ]
+
+# meta protocol ip6 udp dport 67
+inet test-inet input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x0000dd86 ]
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000011 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00004300 ]

diff --git a/tests/py/ip/meta.t b/tests/py/ip/meta.t
index f733d22de2c3b6658e8709ca51624d0131746584..fecd0caf71a72a7f8d936883c47f0e2009cef41c 100644 (file)
--- a/tests/py/ip/meta.t
+++ b/tests/py/ip/meta.t
@@ -8,6 +8,8 @@ meta l4proto ipv6-icmp icmpv6 type nd-router-advert;ok;icmpv6 type nd-router-adv
 meta l4proto 58 icmpv6 type nd-router-advert;ok;icmpv6 type nd-router-advert
 icmpv6 type nd-router-advert;ok
 
+meta protocol ip udp dport 67;ok
+
 meta ibrname "br0";fail
 meta obrname "br0";fail
 

diff --git a/tests/py/ip/meta.t.json b/tests/py/ip/meta.t.json
index f83864f672d5cdaae489acb7c630979a2867ba6f..3df31ce381fc80e7c7ac520402a3c166ce68d5d5 100644 (file)
--- a/tests/py/ip/meta.t.json
+++ b/tests/py/ip/meta.t.json
@@ -140,3 +140,19 @@
         "accept": null
     }
 ]
+
+# meta protocol ip udp dport 67
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 67
+        }
+    }
+]

diff --git a/tests/py/ip/meta.t.payload b/tests/py/ip/meta.t.payload
index 7bc69a290d24e59ca37f898f6dd4551adb6eff13..a1fd00864ef923873a09b1f4e71f2beda8c6d640 100644 (file)
--- a/tests/py/ip/meta.t.payload
+++ b/tests/py/ip/meta.t.payload
@@ -44,3 +44,12 @@ ip6 test-ip4 input
   [ meta load sdifname => reg 1 ]
   [ cmp neq reg 1 0x31667276 0x00000000 0x00000000 0x00000000 ]
   [ immediate reg 0 accept ]
+
+# meta protocol ip udp dport 67
+ip test-ip4 input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000011 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00004300 ]

diff --git a/tests/py/ip6/meta.t b/tests/py/ip6/meta.t
index dce97f5b0fd0a1f20f4e6dd0389ca7122f4efdca..2c1aee2309a929c271bdc285de15ba356573b1f0 100644 (file)
--- a/tests/py/ip6/meta.t
+++ b/tests/py/ip6/meta.t
@@ -9,5 +9,8 @@ meta l4proto icmp icmp type echo-request;ok;icmp type echo-request
 meta l4proto 1 icmp type echo-request;ok;icmp type echo-request
 icmp type echo-request;ok
 
+meta protocol ip udp dport 67;ok
+meta protocol ip6 udp dport 67;ok
+
 meta sdif "lo" accept;ok
 meta sdifname != "vrf1" accept;ok

diff --git a/tests/py/ip6/meta.t.json b/tests/py/ip6/meta.t.json
index e72350f375e90785dd94ce670292cd045ce784c8..351320d70f7c1ca269b93168d08399804e435d3b 100644 (file)
--- a/tests/py/ip6/meta.t.json
+++ b/tests/py/ip6/meta.t.json
@@ -140,3 +140,57 @@
         "accept": null
     }
 ]
+
+# meta protocol ip udp dport 67
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "protocol"
+                }
+            },
+            "op": "==",
+            "right": "ip"
+        }
+    },
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 67
+        }
+    }
+]
+
+# meta protocol ip6 udp dport 67
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "protocol"
+                }
+            },
+            "op": "==",
+            "right": "ip6"
+        }
+    },
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 67
+        }
+    }
+]

diff --git a/tests/py/ip6/meta.t.payload b/tests/py/ip6/meta.t.payload
index be04816eeec2489e795ebf88b5ed6229e3b40455..59c20d994138887213c7f3fedbcd3087890b8b4e 100644 (file)
--- a/tests/py/ip6/meta.t.payload
+++ b/tests/py/ip6/meta.t.payload
@@ -44,3 +44,21 @@ ip6 test-ip6 input
   [ meta load sdifname => reg 1 ]
   [ cmp neq reg 1 0x31667276 0x00000000 0x00000000 0x00000000 ]
   [ immediate reg 0 accept ]
+
+# meta protocol ip udp dport 67
+ip6 test-ip6 input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000011 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00004300 ]
+
+# meta protocol ip6 udp dport 67
+ip6 test-ip6 input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x0000dd86 ]
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000011 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00004300 ]