tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
netfilter: nft_payload: restore vlan q-in-q match support
Revert f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support").
f41f72d09ee1 ("netfilter: nft_payload: simplify vlan header handling")
already allows to match on inner vlan tags by subtract the vlan header
size to the payload offset which has been popped and stored in skbuff
metadata fields.
Fixes: f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+7
-16
+7
-16
net/netfilter/nft_payload.c
+7
-16
net/netfilter/nft_payload.c
···
45
45
int mac_off = skb_mac_header(skb) - skb->data;
46
46
u8 *vlanh, *dst_u8 = (u8 *) d;
47
47
struct vlan_ethhdr veth;
48
-
u8 vlan_hlen = 0;
49
-
50
-
if ((skb->protocol == htons(ETH_P_8021AD) ||
51
-
skb->protocol == htons(ETH_P_8021Q)) &&
52
-
offset >= VLAN_ETH_HLEN && offset < VLAN_ETH_HLEN + VLAN_HLEN)
53
-
vlan_hlen += VLAN_HLEN;
54
48
55
49
vlanh = (u8 *) &veth;
56
-
if (offset < VLAN_ETH_HLEN + vlan_hlen) {
50
+
if (offset < VLAN_ETH_HLEN) {
57
51
u8 ethlen = len;
58
52
59
-
if (vlan_hlen &&
60
-
skb_copy_bits(skb, mac_off, &veth, VLAN_ETH_HLEN) < 0)
61
-
return false;
62
-
else if (!nft_payload_rebuild_vlan_hdr(skb, mac_off, &veth))
53
+
if (!nft_payload_rebuild_vlan_hdr(skb, mac_off, &veth))
63
54
return false;
64
55
65
-
if (offset + len > VLAN_ETH_HLEN + vlan_hlen)
66
-
ethlen -= offset + len - VLAN_ETH_HLEN - vlan_hlen;
56
+
if (offset + len > VLAN_ETH_HLEN)
57
+
ethlen -= offset + len - VLAN_ETH_HLEN;
67
58
68
-
memcpy(dst_u8, vlanh + offset - vlan_hlen, ethlen);
59
+
memcpy(dst_u8, vlanh + offset, ethlen);
69
60
70
61
len -= ethlen;
71
62
if (len == 0)
72
63
return true;
73
64
74
65
dst_u8 += ethlen;
75
-
offset = ETH_HLEN + vlan_hlen;
66
+
offset = ETH_HLEN;
76
67
} else {
77
-
offset -= VLAN_HLEN + vlan_hlen;
68
+
offset -= VLAN_HLEN;
78
69
}
79
70
80
71
return skb_copy_bits(skb, offset + mac_off, dst_u8, len) == 0;