shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 18:41:58 +09:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: br_netfilter: fix recent physdev match breakage

Browse Source 
[ Upstream commit 94623f579c ]

Recent attempt to ensure PREROUTING hook is executed again when a
decrypted ipsec packet received on a bridge passes through the network
stack a second time broke the physdev match in INPUT hook.

We can't discard the nf_bridge info strct from sabotage_in hook, as
this is needed by the physdev match.

Keep the struct around and handle this with another conditional instead.

Fixes: 2b272bb558 ("netfilter: br_netfilter: disable sabotage_in hook after first suppression")
Reported-and-tested-by: Farid BENAMROUCHE <fariouche@yahoo.fr>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Florian Westphal
2023-04-03 13:54:37 +02:00
committed by Greg Kroah-Hartman
parent 08b78037c4
commit 3224458030
2 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/skbuff.h
View File

@@ -258,6 +258,7 @@ struct nf_bridge_info {
u8 pkt_otherhost:1; u8 pkt_otherhost:1;
u8 in_prerouting:1; u8 in_prerouting:1;
u8 bridged_dnat:1; u8 bridged_dnat:1;
u8 sabotage_in_done:1;
__u16 frag_max_size; __u16 frag_max_size;
struct net_device *physindev; struct net_device *physindev;

17
net/bridge/br_netfilter_hooks.c
View File

@@ -868,12 +868,17 @@ static unsigned int ip_sabotage_in(void *priv,
{ {
struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
if (nf_bridge && !nf_bridge->in_prerouting && if (nf_bridge) {
!netif_is_l3_master(skb->dev) && if (nf_bridge->sabotage_in_done)
!netif_is_l3_slave(skb->dev)) { return NF_ACCEPT;
nf_bridge_info_free(skb);
state->okfn(state->net, state->sk, skb); if (!nf_bridge->in_prerouting &&
return NF_STOLEN; !netif_is_l3_master(skb->dev) &&
!netif_is_l3_slave(skb->dev)) {
nf_bridge->sabotage_in_done = 1;
state->okfn(state->net, state->sk, skb);
return NF_STOLEN;
}
} }
return NF_ACCEPT; return NF_ACCEPT;