lkml.org 
[lkml]   [2019]   [Dec]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 025/321] bridge: ebtables: dont crash when using dnat target in output chains
    Date
    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ]

    xt_in() returns NULL in the output hook, skip the pkt_type change for
    that case, redirection only makes sense in broute/prerouting hooks.

    Reported-by: Tom Yan <tom.ty89@gmail.com>
    Cc: Linus Lüssing <linus.luessing@c0d3.blue>
    Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bridge/netfilter/ebt_dnat.c | 19 +++++++++++++++----
    1 file changed, 15 insertions(+), 4 deletions(-)

    diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
    index dfc86a0199dab..1d8c834d90189 100644
    --- a/net/bridge/netfilter/ebt_dnat.c
    +++ b/net/bridge/netfilter/ebt_dnat.c
    @@ -19,7 +19,6 @@ static unsigned int
    ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
    {
    const struct ebt_nat_info *info = par->targinfo;
    - struct net_device *dev;

    if (!skb_make_writable(skb, 0))
    return EBT_DROP;
    @@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
    else
    skb->pkt_type = PACKET_MULTICAST;
    } else {
    - if (xt_hooknum(par) != NF_BR_BROUTING)
    - dev = br_port_get_rcu(xt_in(par))->br->dev;
    - else
    + const struct net_device *dev;
    +
    + switch (xt_hooknum(par)) {
    + case NF_BR_BROUTING:
    dev = xt_in(par);
    + break;
    + case NF_BR_PRE_ROUTING:
    + dev = br_port_get_rcu(xt_in(par))->br->dev;
    + break;
    + default:
    + dev = NULL;
    + break;
    + }
    +
    + if (!dev) /* NF_BR_LOCAL_OUT */
    + return info->target;

    if (ether_addr_equal(info->mac, dev->dev_addr))
    skb->pkt_type = PACKET_HOST;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-12-03 23:46    [W:4.137 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site