evaluate: enable reject with 802.1q

This enables the use nft bridge reject with bridge vlan filtering.

It depends on a kernel patch to make the kernel preserve the
vlan id in nft bridge reject generation.

[ pablo: update tests/py ]

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 506f2c6a257e4d055f54c2d2ac875ce0c071899a..985ae4fe4aae438c9fe8cd33dbf10334e407ee11 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2616,7 +2616,7 @@ static int stmt_evaluate_reject_bridge(struct eval_ctx *ctx, struct stmt *stmt,
        const struct proto_desc *desc;
 
        desc = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
-       if (desc != &proto_eth)
+       if (desc != &proto_eth && desc != &proto_vlan)
                return stmt_binary_error(ctx,
                                         &ctx->pctx.protocol[PROTO_BASE_LL_HDR],
                                         stmt, "unsupported link layer protocol");

diff --git a/tests/py/bridge/reject.t b/tests/py/bridge/reject.t
index ee7e93c814497da4d0bf6b5add71e14789eb24d0..f5ed203815e5edaa7fc621a75fc939a2ad621ac4 100644 (file)
--- a/tests/py/bridge/reject.t
+++ b/tests/py/bridge/reject.t
@@ -30,15 +30,13 @@ reject with icmpx type port-unreachable;ok;reject
 ether type ipv6 reject with icmp type host-unreachable;fail
 ether type ip6 reject with icmp type host-unreachable;fail
 ether type ip reject with icmpv6 type no-route;fail
-ether type vlan reject;fail
+ether type vlan reject;ok
 ether type arp reject;fail
-ether type vlan reject;fail
-ether type arp reject;fail
-ether type vlan reject with tcp reset;fail
+ether type vlan reject with tcp reset;ok
 ether type arp reject with tcp reset;fail
 ip protocol udp reject with tcp reset;fail
 
 ether type ip reject with icmpx type admin-prohibited;ok
 ether type ip6 reject with icmpx type admin-prohibited;ok
-ether type vlan reject with icmpx type admin-prohibited;fail
+ether type vlan reject with icmpx type admin-prohibited;ok
 ether type arp reject with icmpx type admin-prohibited;fail

diff --git a/tests/py/bridge/reject.t.payload b/tests/py/bridge/reject.t.payload
index 0d10547bbce600fd942eedd9d26e23593579852f..7deb6fbf5facd0bddf30ba37127b1fafa2a83f2a 100644 (file)
--- a/tests/py/bridge/reject.t.payload
+++ b/tests/py/bridge/reject.t.payload
@@ -118,3 +118,23 @@ bridge test-bridge input
   [ cmp eq reg 1 0x0000dd86 ]
   [ reject type 2 code 3 ]
 
+# ether type vlan reject
+bridge
+  [ payload load 2b @ link header + 12 => reg 1 ]
+  [ cmp eq reg 1 0x00000081 ]
+  [ reject type 2 code 1 ]
+
+# ether type vlan reject with tcp reset
+bridge
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000006 ]
+  [ payload load 2b @ link header + 12 => reg 1 ]
+  [ cmp eq reg 1 0x00000081 ]
+  [ reject type 1 code 0 ]
+
+# ether type vlan reject with icmpx type admin-prohibited
+bridge
+  [ payload load 2b @ link header + 12 => reg 1 ]
+  [ cmp eq reg 1 0x00000081 ]
+  [ reject type 2 code 3 ]
+