extensions: libebt_ip: Do not use 'ip dscp' for translation

Converting from TOS field match to DSCP one is irreversible, so replay
testing is not possible. Use a raw payload expression to produce
something that translates 1:1 back into an 'ip' match.

Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations")
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c
index fd87dae7e2c6293ffe5f6cdb74977be989b9bfad..8b381aa10b5b73bac8e424c55771b1c5830cf00b 100644 (file)
--- a/extensions/libebt_ip.c
+++ b/extensions/libebt_ip.c
@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl,
        brip_xlate_nh(xl, info, EBT_IP_DEST);
 
        if (info->bitmask & EBT_IP_TOS) {
-               xt_xlate_add(xl, "ip dscp ");
+               xt_xlate_add(xl, "@nh,8,8 ");
                if (info->invflags & EBT_IP_TOS)
                        xt_xlate_add(xl, "!= ");
-               xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */
+               xt_xlate_add(xl, "0x%02x ", info->tos);
        }
        if (info->bitmask & EBT_IP_PROTO) {
                struct protoent *pe;

diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate
index 75c1db246fb81678a905e3466de55882cf487e81..562e3157d7b925ba6b7a5f1775db910a74a4d027 100644 (file)
--- a/extensions/libebt_ip.txlate
+++ b/extensions/libebt_ip.txlate
@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1
 nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter'
 
 ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff
-nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter'
+nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter'
 
 ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22
 nft 'add rule bridge filter FORWARD tcp dport 22 counter'