From: Phil Sutter Date: Fri, 3 Feb 2023 17:58:36 +0000 (+0100) Subject: extensions: libebt_ip: Do not use 'ip dscp' for translation X-Git-Tag: v1.8.10~79 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=744c56bda974caaa274318d2825b3e43b55bf145;p=thirdparty%2Fiptables.git extensions: libebt_ip: Do not use 'ip dscp' for translation Converting from TOS field match to DSCP one is irreversible, so replay testing is not possible. Use a raw payload expression to produce something that translates 1:1 back into an 'ip' match. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter --- diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c index fd87dae7..8b381aa1 100644 --- a/extensions/libebt_ip.c +++ b/extensions/libebt_ip.c @@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, brip_xlate_nh(xl, info, EBT_IP_DEST); if (info->bitmask & EBT_IP_TOS) { - xt_xlate_add(xl, "ip dscp "); + xt_xlate_add(xl, "@nh,8,8 "); if (info->invflags & EBT_IP_TOS) xt_xlate_add(xl, "!= "); - xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ + xt_xlate_add(xl, "0x%02x ", info->tos); } if (info->bitmask & EBT_IP_PROTO) { struct protoent *pe; diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate index 75c1db24..562e3157 100644 --- a/extensions/libebt_ip.txlate +++ b/extensions/libebt_ip.txlate @@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff -nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' +nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 nft 'add rule bridge filter FORWARD tcp dport 22 counter'