| Message ID | 20230418145048.67270-2-pablo@netfilter.org |
|---|---|
| State | Accepted, archived |
| Headers | show |
| Series | [net,1/5] netfilter: br_netfilter: fix recent physdev match breakage | expand |
Hello: This series was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Tue, 18 Apr 2023 16:50:44 +0200 you wrote: > From: Florian Westphal <fw@strlen.de> > > Recent attempt to ensure PREROUTING hook is executed again when a > decrypted ipsec packet received on a bridge passes through the network > stack a second time broke the physdev match in INPUT hook. > > We can't discard the nf_bridge info strct from sabotage_in hook, as > this is needed by the physdev match. > > [...] Here is the summary with links: - [net,1/5] netfilter: br_netfilter: fix recent physdev match breakage https://git.kernel.org/netdev/net/c/94623f579ce3 - [net,2/5] netfilter: nf_tables: Modify nla_memdup's flag to GFP_KERNEL_ACCOUNT https://git.kernel.org/netdev/net/c/af0acf22aea3 - [net,3/5] netfilter: nf_tables: fix ifdef to also consider nf_tables=m https://git.kernel.org/netdev/net/c/c55c0e91c813 - [net,4/5] netfilter: nf_tables: validate catch-all set elements https://git.kernel.org/netdev/net/c/d46fc894147c - [net,5/5] netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements https://git.kernel.org/netdev/net/c/d4eb7e39929a You are awesome, thank you!
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index ff7ad331fb82..1ec3530c8191 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -294,6 +294,7 @@ struct nf_bridge_info { u8 pkt_otherhost:1; u8 in_prerouting:1; u8 bridged_dnat:1; + u8 sabotage_in_done:1; __u16 frag_max_size; struct net_device *physindev; diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c index 638a4d5359db..4bc6761517bb 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -868,12 +868,17 @@ static unsigned int ip_sabotage_in(void *priv, { struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); - if (nf_bridge && !nf_bridge->in_prerouting && - !netif_is_l3_master(skb->dev) && - !netif_is_l3_slave(skb->dev)) { - nf_bridge_info_free(skb); - state->okfn(state->net, state->sk, skb); - return NF_STOLEN; + if (nf_bridge) { + if (nf_bridge->sabotage_in_done) + return NF_ACCEPT; + + if (!nf_bridge->in_prerouting && + !netif_is_l3_master(skb->dev) && + !netif_is_l3_slave(skb->dev)) { + nf_bridge->sabotage_in_done = 1; + state->okfn(state->net, state->sk, skb); + return NF_STOLEN; + } } return NF_ACCEPT;