diff options
| author | wenxu <wenxu@ucloud.cn> | 2019-07-05 15:16:37 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-07-05 21:34:50 +0200 |
| commit | 2a3a93ef0ba5166e8b5766bb232f216fd412d40b (patch) | |
| tree | 880ff034a53231f6d3742034084ac516483407d2 /net | |
| parent | bridge: add br_vlan_get_proto() (diff) | |
| download | linux-2a3a93ef0ba5166e8b5766bb232f216fd412d40b.tar.xz linux-2a3a93ef0ba5166e8b5766bb232f216fd412d40b.zip | |
netfilter: nft_meta_bridge: Add NFT_META_BRI_IIFVPROTO support
This patch allows you to match on bridge vlan protocol, eg.
nft add rule bridge firewall zones counter meta ibrvproto 0x8100
Signed-off-by: wenxu <wenxu@ucloud.cn>
Reviewed-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bridge/netfilter/nft_meta_bridge.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c index 9487d42f657a..bed66f536b34 100644 --- a/net/bridge/netfilter/nft_meta_bridge.c +++ b/net/bridge/netfilter/nft_meta_bridge.c @@ -49,6 +49,17 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr, nft_reg_store16(dest, p_pvid); return; } + case NFT_META_BRI_IIFVPROTO: { + u16 p_proto; + + br_dev = nft_meta_get_bridge(in); + if (!br_dev || !br_vlan_enabled(br_dev)) + goto err; + + br_vlan_get_proto(br_dev, &p_proto); + nft_reg_store16(dest, p_proto); + return; + } default: goto out; } @@ -75,6 +86,7 @@ static int nft_meta_bridge_get_init(const struct nft_ctx *ctx, len = IFNAMSIZ; break; case NFT_META_BRI_IIFPVID: + case NFT_META_BRI_IIFVPROTO: len = sizeof(u16); break; default: |