mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 18:30:06 +00:00
bridge: ebtables: don't crash when using dnat target in output chains
[ Upstream commitb23c0742c2
] xt_in() returns NULL in the output hook, skip the pkt_type change for that case, redirection only makes sense in broute/prerouting hooks. Reported-by: Tom Yan <tom.ty89@gmail.com> Cc: Linus Lüssing <linus.luessing@c0d3.blue> Fixes:cf3cb246e2
("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
3c4879a381
commit
6fc27a2497
1 changed files with 15 additions and 4 deletions
|
@ -19,7 +19,6 @@ static unsigned int
|
|||
ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
|
||||
{
|
||||
const struct ebt_nat_info *info = par->targinfo;
|
||||
struct net_device *dev;
|
||||
|
||||
if (!skb_make_writable(skb, 0))
|
||||
return EBT_DROP;
|
||||
|
@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
|
|||
else
|
||||
skb->pkt_type = PACKET_MULTICAST;
|
||||
} else {
|
||||
if (xt_hooknum(par) != NF_BR_BROUTING)
|
||||
dev = br_port_get_rcu(xt_in(par))->br->dev;
|
||||
else
|
||||
const struct net_device *dev;
|
||||
|
||||
switch (xt_hooknum(par)) {
|
||||
case NF_BR_BROUTING:
|
||||
dev = xt_in(par);
|
||||
break;
|
||||
case NF_BR_PRE_ROUTING:
|
||||
dev = br_port_get_rcu(xt_in(par))->br->dev;
|
||||
break;
|
||||
default:
|
||||
dev = NULL;
|
||||
break;
|
||||
}
|
||||
|
||||
if (!dev) /* NF_BR_LOCAL_OUT */
|
||||
return info->target;
|
||||
|
||||
if (ether_addr_equal(info->mac, dev->dev_addr))
|
||||
skb->pkt_type = PACKET_HOST;
|
||||
|
|
Loading…
Reference in a new issue