lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 025/114] netfilter: bridge: add support for pppoe filtering
    Date
    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ]

    This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for
    bridged traffic.

    Looking at the original commit it doesn't appear this ever worked:

    static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
    [..]
    if (skb->protocol == htons(ETH_P_8021Q)) {
    skb_pull(skb, VLAN_HLEN);
    skb->network_header += VLAN_HLEN;
    + } else if (skb->protocol == htons(ETH_P_PPP_SES)) {
    + skb_pull(skb, PPPOE_SES_HLEN);
    + skb->network_header += PPPOE_SES_HLEN;
    }
    [..]
    NF_HOOK(... POST_ROUTING, ...)

    ... but the adjusted offsets are never restored.

    The alternative would be to rip this code out for good,
    but otoh we'd have to keep this anyway for the vlan handling
    (which works because vlan tag info is in the skb, not the packet
    payload).

    Reported-and-tested-by: Amish Chana <amish@3g.co.za>
    Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 encapsulated in pppoe traffic")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bridge/br_netfilter_hooks.c | 7 +++----
    1 file changed, 3 insertions(+), 4 deletions(-)

    diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
    index 24eea13035557..f580dbaac5a94 100644
    --- a/net/bridge/br_netfilter_hooks.c
    +++ b/net/bridge/br_netfilter_hooks.c
    @@ -719,6 +719,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
    if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
    mtu = nf_bridge->frag_max_size;

    + nf_bridge_update_protocol(skb);
    + nf_bridge_push_encap_header(skb);
    +
    if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
    nf_bridge_info_free(skb);
    return br_dev_queue_push_xmit(net, sk, skb);
    @@ -736,8 +739,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff

    IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;

    - nf_bridge_update_protocol(skb);
    -
    data = this_cpu_ptr(&brnf_frag_data_storage);

    data->vlan_tci = skb->vlan_tci;
    @@ -760,8 +761,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff

    IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;

    - nf_bridge_update_protocol(skb);
    -
    data = this_cpu_ptr(&brnf_frag_data_storage);
    data->encap_size = nf_bridge_encap_header_len(skb);
    data->size = ETH_HLEN + data->encap_size;
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 19:50    [W:4.112 / U:0.160 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site