Received: by 2002:a05:6a10:2726:0:0:0:0 with SMTP id ib38csp608324pxb; Tue, 5 Apr 2022 15:50:04 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyYnv1Cx92sbTfX2IEU5svzAwn/bExifqAvtXw/ka41fWMdiVsKxbAJjdVtcG+3C1j4aPAY X-Received: by 2002:a17:903:124a:b0:154:c7a4:9374 with SMTP id u10-20020a170903124a00b00154c7a49374mr5616043plh.68.1649199004165; Tue, 05 Apr 2022 15:50:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1649199004; cv=none; d=google.com; s=arc-20160816; b=kcDDaRL9rvpfv27vIO5ClvylMGgzCCfFpS8aTnpB3tBO2PoIO+txS+33un5ZYknoLd qRoCVO5s7Nl2CjjN+rP7ud77cLYukBcByvoSAfz4PbfA4HpnARle9cHgZAO9M4BI9m6m jNijOdFrwV5CxHO+avp3dk4yfGfT5FWHtu+ti7d//VV6s3P1b2u/ZJv/h60ilccTY2X6 Rblvqki8J7rGfavBgTzqy/BvvJ9gOSoCnIvZkbGnhNWs4GqX9XUXJyYORvffQuzF+Sg4 qGzHGuyG50Ag0uN6Fy2lPeSnZjnoSLltssP41a/++fRWdUprQX9mWIsecINYISVem3hF cHtw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=SoxuuxEUc4J5pj9wZWOfKi9PIWsIHrvWCNMqspsqSO4=; b=ahqlX7krze7FuQnJcHxjpKh6O/T5vJodcZV0KDxTXHowwpvh6Xu+8dWSz46sC7TiD8 90e22GLJXFF0bC01Yo3z/3Qmu8xyOnYDIu24xm7x+N1KzPG8CSUzFieSpPKR7ZOwG1ef nLxcaJ9pbuWJ5zKWzMdjmiSupQdy7Ogj6WpUnLz9jstj3Va3/OWsRJCgCRGdYrbsUI+r 0YWtLN2z36BHp/AF45Z3n1skRQM+82sjFd1WRIv+H+YVrumcTPqg7mpS96ROzYQSWejz ntU9YqK76uIU6S9K62mDoqYCWuTVYCOq4OXUCXWrRb8XACjFtGIiEFT9W8jPqIevsY2i vlqQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=KukfwuQK; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [2620:137:e000::1:18]) by mx.google.com with ESMTPS id n20-20020a170902969400b00153b2d1665csi12843462plp.612.2022.04.05.15.50.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 05 Apr 2022 15:50:04 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=KukfwuQK; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 047977484C; Tue, 5 Apr 2022 15:32:06 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356974AbiDEMuv (ORCPT + 99 others); Tue, 5 Apr 2022 08:50:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43798 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244248AbiDEJJu (ORCPT ); Tue, 5 Apr 2022 05:09:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA29015FCE; Tue, 5 Apr 2022 01:59:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1F33A61561; Tue, 5 Apr 2022 08:59:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3022EC385A0; Tue, 5 Apr 2022 08:59:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649149141; bh=ef63SUoVK6J5b3AlqYjE7V+Dbi7YliJ+HCPpNgIERHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KukfwuQK7dSJeUv/IUbbhhutlAfWcqluZ+tmykLD2Zmkk9OlHJBL+67EqlWB6tk6+ G8L12xtFiV4ya4B6hOKckjNFcqZq1vt5svqt3OZjfNeNNkGt4hz4slQqr54rkYxs5k wvFIGzy7hlYMJBfAX6tcHCNkwCVGDo0FGE8flQTQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.16 0609/1017] netfilter: flowtable: Fix QinQ and pppoe support for inet table Date: Tue, 5 Apr 2022 09:25:22 +0200 Message-Id: <20220405070412.357675167@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070354.155796697@linuxfoundation.org> References: <20220405070354.155796697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pablo Neira Ayuso [ Upstream commit 0492d857636e1c52cd71594a723c4b26a7b31978 ] nf_flow_offload_inet_hook() does not check for 802.1q and PPPoE. Fetch inner ethertype from these encapsulation protocols. Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support") Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- include/net/netfilter/nf_flow_table.h | 18 ++++++++++++++++++ net/netfilter/nf_flow_table_inet.c | 17 +++++++++++++++++ net/netfilter/nf_flow_table_ip.c | 18 ------------------ 3 files changed, 35 insertions(+), 18 deletions(-) diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index a3647fadf1cc..9f927c44087d 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -10,6 +10,8 @@ #include #include #include +#include +#include struct nf_flowtable; struct nf_flow_rule; @@ -313,4 +315,20 @@ int nf_flow_rule_route_ipv6(struct net *net, const struct flow_offload *flow, int nf_flow_table_offload_init(void); void nf_flow_table_offload_exit(void); +static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb) +{ + __be16 proto; + + proto = *((__be16 *)(skb_mac_header(skb) + ETH_HLEN + + sizeof(struct pppoe_hdr))); + switch (proto) { + case htons(PPP_IP): + return htons(ETH_P_IP); + case htons(PPP_IPV6): + return htons(ETH_P_IPV6); + } + + return 0; +} + #endif /* _NF_FLOW_TABLE_H */ diff --git a/net/netfilter/nf_flow_table_inet.c b/net/netfilter/nf_flow_table_inet.c index bc4126d8ef65..280fdd32965f 100644 --- a/net/netfilter/nf_flow_table_inet.c +++ b/net/netfilter/nf_flow_table_inet.c @@ -6,12 +6,29 @@ #include #include #include +#include static unsigned int nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { + struct vlan_ethhdr *veth; + __be16 proto; + switch (skb->protocol) { + case htons(ETH_P_8021Q): + veth = (struct vlan_ethhdr *)skb_mac_header(skb); + proto = veth->h_vlan_encapsulated_proto; + break; + case htons(ETH_P_PPP_SES): + proto = nf_flow_pppoe_proto(skb); + break; + default: + proto = skb->protocol; + break; + } + + switch (proto) { case htons(ETH_P_IP): return nf_flow_offload_ip_hook(priv, skb, state); case htons(ETH_P_IPV6): diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 889cf88d3dba..6257d87c3a56 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -8,8 +8,6 @@ #include #include #include -#include -#include #include #include #include @@ -239,22 +237,6 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb, return NF_STOLEN; } -static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb) -{ - __be16 proto; - - proto = *((__be16 *)(skb_mac_header(skb) + ETH_HLEN + - sizeof(struct pppoe_hdr))); - switch (proto) { - case htons(PPP_IP): - return htons(ETH_P_IP); - case htons(PPP_IPV6): - return htons(ETH_P_IPV6); - } - - return 0; -} - static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto, u32 *offset) { -- 2.34.1