From patchwork Wed Feb 17 00:41:31 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jay Vosburgh X-Patchwork-Id: 583784 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id E72AB1402DD; Wed, 17 Feb 2016 11:42:18 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1aVqC8-0005SR-Nu; Wed, 17 Feb 2016 00:42:16 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1aVqBr-0005Nq-0n for kernel-team@lists.ubuntu.com; Wed, 17 Feb 2016 00:41:59 +0000 Received: from c-67-183-59-65.hsd1.wa.comcast.net ([67.183.59.65] helo=famine.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1aVqBq-00029l-FH for kernel-team@lists.ubuntu.com; Wed, 17 Feb 2016 00:41:58 +0000 From: Jay Vosburgh To: kernel-team@lists.ubuntu.com Subject: [SRU][Trusty][PATCH v2 2/4] netfilter: bridge: restore vlan tag when refragmenting Date: Tue, 16 Feb 2016 16:41:31 -0800 Message-Id: <1455669693-19975-3-git-send-email-jay.vosburgh@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1455669693-19975-1-git-send-email-jay.vosburgh@canonical.com> References: <1455669693-19975-1-git-send-email-jay.vosburgh@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Florian Westphal BugLink: https://bugs.launchpad.net/nova/+bug/1463911 If bridge netfilter is used with both bridge-nf-call-iptables and bridge-nf-filter-vlan-tagged enabled then ip fragments in VLAN frames are sent without the vlan header. This has never worked reliably. Turns out this relied on pre-3.5 behaviour where skb frag_list was used to store ip fragments; ip_fragment() then re-used these skbs. But since commit 3cc4949269e01f39443d0fcfffb5bc6b47878d45 ("ipv4: use skb coalescing in defragmentation") this is no longer the case. ip_do_fragment now needs to allocate new skbs, but these don't contain the vlan tag information anymore. Fix it by storing vlan information of the ressembled skb in the br netfilter percpu frag area, and restore them for each of the fragments. Fixes: 3cc4949269e01f3 ("ipv4: use skb coalescing in defragmentation") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso (backported from commit d7b597421519d6f680eb8e152a0d8447466ee2d6) Signed-off-by: Jay Vosburgh --- net/bridge/br_netfilter.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index 6143a6f37c0e..247b5584d39a 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -179,6 +179,8 @@ struct brnf_frag_data { char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH]; u8 encap_size; u8 size; + u16 vlan_tci; + __be16 vlan_proto; }; static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage); @@ -886,6 +888,11 @@ static int br_nf_push_frag_xmit(struct sk_buff *skb) return 0; } + if (data->vlan_tci) { + skb->vlan_tci = data->vlan_tci; + skb->vlan_proto = data->vlan_proto; + } + skb_copy_to_linear_data_offset(skb, -data->size, data->mac, data->size); __skb_push(skb, data->encap_size); @@ -908,6 +915,9 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb) nf_bridge_update_protocol(skb); data = this_cpu_ptr(&brnf_frag_data_storage); + + data->vlan_tci = skb->vlan_tci; + data->vlan_proto = skb->vlan_proto; data->encap_size = nf_bridge_encap_header_len(skb); data->size = ETH_HLEN + data->encap_size;