meta: add ibrpvid and ibrvproto support

This allows you to match the bridge pvid and vlan protocol, for
instance:

nft add rule bridge firewall zones meta ibrvproto vlan
nft add rule bridge firewall zones meta ibrpvid 100

Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/meta.c b/src/meta.c
index 5901c9919ed80ed07ba1f99565c22a5788a44333..0cd7eeeab8b523c3771034f31a3c64975b0f16ce 100644 (file)
--- a/src/meta.c
+++ b/src/meta.c
@@ -442,6 +442,12 @@ const struct meta_template meta_templates[] = {
        [NFT_META_OIFKIND]      = META_TEMPLATE("oifkind",   &ifname_type,
                                                IFNAMSIZ * BITS_PER_BYTE,
                                                BYTEORDER_HOST_ENDIAN),
+       [NFT_META_BRI_IIFPVID]  = META_TEMPLATE("ibrpvid",   &integer_type,
+                                               2 * BITS_PER_BYTE,
+                                               BYTEORDER_HOST_ENDIAN),
+       [NFT_META_BRI_IIFVPROTO] = META_TEMPLATE("ibrvproto",   &ethertype_type,
+                                                2 * BITS_PER_BYTE,
+                                                BYTEORDER_BIG_ENDIAN),
 };
 
 static bool meta_key_is_unqualified(enum nft_meta_keys key)

diff --git a/tests/py/bridge/meta.t b/tests/py/bridge/meta.t
index 88e819f7768c0d993bd9927067e150f8e9c98c81..94525f2944ce5f40525e94db26babfb1c68d0186 100644 (file)
--- a/tests/py/bridge/meta.t
+++ b/tests/py/bridge/meta.t
@@ -4,3 +4,5 @@
 
 meta obrname "br0";ok
 meta ibrname "br0";ok
+meta ibrvproto vlan;ok
+meta ibrpvid 100;ok

diff --git a/tests/py/bridge/meta.t.json b/tests/py/bridge/meta.t.json
index 5df4773aa1e7307017ca8da9763712416099d8cd..a7a180c29aa600cdf3893c703ff936d4c4524f2d 100644 (file)
--- a/tests/py/bridge/meta.t.json
+++ b/tests/py/bridge/meta.t.json
@@ -23,3 +23,29 @@
         }
     }
 ]
+
+# meta ibrvproto vlan
+[
+    {
+        "match": {
+            "left": {
+                "meta": { "key": "ibrvproto" }
+            },
+           "op": "==",
+            "right": "vlan"
+        }
+    }
+]
+
+# meta ibrpvid 100
+[
+    {
+        "match": {
+            "left": {
+                "meta": { "key": "ibrpvid" }
+            },
+           "op": "==",
+            "right": 100
+        }
+    }
+]

diff --git a/tests/py/bridge/meta.t.payload b/tests/py/bridge/meta.t.payload
index 0f0d101781c10807a393d15718e83d55453f7b71..aa8c994bfe58ff6b2e2013fd7bed473354b2a97b 100644 (file)
--- a/tests/py/bridge/meta.t.payload
+++ b/tests/py/bridge/meta.t.payload
@@ -8,3 +8,12 @@ bridge test-bridge input
   [ meta load bri_iifname => reg 1 ]
   [ cmp eq reg 1 0x00307262 0x00000000 0x00000000 0x00000000 ]
 
+# meta ibrvproto vlan
+bridge test-bridge input
+  [ meta load bri_iifvproto => reg 1 ]
+  [ cmp eq reg 1 0x00000081 ]
+
+# meta ibrpvid 100
+bridge test-bridge input
+  [ meta load bri_iifpvid => reg 1 ]
+  [ cmp eq reg 1 0x00000064 ]