| Message ID | 20231004141405.28749-2-fw@strlen.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | af84f9e447a65b4b9f79e7e5d69e19039b431c56 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/6] netfilter: nft_payload: rebuild vlan header on h_proto access | expand |
Hello: This series was applied to netdev/net.git (main) by Florian Westphal <fw@strlen.de>: On Wed, 4 Oct 2023 16:13:45 +0200 you wrote: > nft can perform merging of adjacent payload requests. > This means that: > > ether saddr 00:11 ... ether type 8021ad ... > > is a single payload expression, for 8 bytes, starting at the > ethernet source offset. > > [...] Here is the summary with links: - [net,1/6] netfilter: nft_payload: rebuild vlan header on h_proto access https://git.kernel.org/netdev/net/c/af84f9e447a6 - [net,2/6] netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp https://git.kernel.org/netdev/net/c/8e56b063c865 - [net,3/6] selftests: netfilter: test for sctp collision processing in nf_conntrack https://git.kernel.org/netdev/net/c/cf791b22bef7 - [net,4/6] selftests: netfilter: Extend nft_audit.sh https://git.kernel.org/netdev/net/c/203bb9d39866 - [net,5/6] netfilter: nf_tables: Deduplicate nft_register_obj audit logs https://git.kernel.org/netdev/net/c/0d880dc6f032 - [net,6/6] netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure https://git.kernel.org/netdev/net/c/087388278e0f You are awesome, thank you!
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c index 8cb800989947..120f6d395b98 100644 --- a/net/netfilter/nft_payload.c +++ b/net/netfilter/nft_payload.c @@ -154,6 +154,17 @@ int nft_payload_inner_offset(const struct nft_pktinfo *pkt) return pkt->inneroff; } +static bool nft_payload_need_vlan_copy(const struct nft_payload *priv) +{ + unsigned int len = priv->offset + priv->len; + + /* data past ether src/dst requested, copy needed */ + if (len > offsetof(struct ethhdr, h_proto)) + return true; + + return false; +} + void nft_payload_eval(const struct nft_expr *expr, struct nft_regs *regs, const struct nft_pktinfo *pkt) @@ -172,7 +183,7 @@ void nft_payload_eval(const struct nft_expr *expr, goto err; if (skb_vlan_tag_present(skb) && - priv->offset >= offsetof(struct ethhdr, h_proto)) { + nft_payload_need_vlan_copy(priv)) { if (!nft_payload_copy_vlan(dest, skb, priv->offset, priv->len)) goto err;
nft can perform merging of adjacent payload requests. This means that: ether saddr 00:11 ... ether type 8021ad ... is a single payload expression, for 8 bytes, starting at the ethernet source offset. Check that offset+length is fully within the source/destination mac addersses. This bug prevents 'ether type' from matching the correct h_proto in case vlan tag got stripped. Fixes: de6843be3082 ("netfilter: nft_payload: rebuild vlan header when needed") Reported-by: David Ward <david.ward@ll.mit.edu> Signed-off-by: Florian Westphal <fw@strlen.de> --- net/netfilter/nft_payload.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)