No description
Find a file
Pablo Neira Ayuso 0ae8e4cca7 netfilter: nf_tables: set transport offset from mac header for netdev/egress
Before this patch, transport offset (pkt->thoff) provides an offset
relative to the network header. This is fine for the inet families
because skb->data points to the network header in such case. However,
from netdev/egress, skb->data points to the mac header (if available),
thus, pkt->thoff is missing the mac header length.

Add skb_network_offset() to the transport offset (pkt->thoff) for
netdev, so transport header mangling works as expected. Adjust payload
fast eval function to use skb->data now that pkt->thoff provides an
absolute offset. This explains why users report that matching on
egress/netdev works but payload mangling does not.

This patch implicitly fixes payload mangling for IPv4 packets in
netdev/egress given skb_store_bits() requires an offset from skb->data
to reach the transport header.

I suspect that nft_exthdr and the trace infra were also broken from
netdev/egress because they also take skb->data as start, and pkt->thoff
was not correct.

Note that IPv6 is fine because ipv6_find_hdr() already provides a
transport offset starting from skb->data, which includes
skb_network_offset().

The bridge family also uses nft_set_pktinfo_ipv4_validate(), but there
skb_network_offset() is zero, so the update in this patch does not alter
the existing behaviour.

Fixes: 42df6e1d22 ("netfilter: Introduce egress hook")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2023-12-20 10:43:21 +01:00
arch Current release - regressions: 2023-12-14 13:11:49 -08:00
block block-6.7-2023-12-01 2023-12-02 06:39:30 +09:00
certs This update includes the following changes: 2023-11-02 16:15:30 -10:00
crypto This push fixes a regression in ahash and hides the Kconfig sub-options for the jitter RNG. 2023-11-09 17:04:58 -08:00
Documentation fuse fixes for 6.7-rc6 2023-12-12 11:06:41 -08:00
drivers net: mana: select PAGE_POOL 2023-12-19 12:18:55 +01:00
fs for-6.7-rc5-tag 2023-12-14 11:53:00 -08:00
include netfilter: nf_tables: set transport offset from mac header for netdev/egress 2023-12-20 10:43:21 +01:00
init As usual, lots of singleton and doubleton patches all over the tree and 2023-11-02 20:53:31 -10:00
io_uring io_uring/af_unix: disable sending io_uring over sockets 2023-12-09 21:20:33 +00:00
ipc Many singleton patches against the MM code. The patch series which are 2023-11-02 19:38:47 -10:00
kernel - Make sure tasks are thawed exactly and only once to avoid their state 2023-12-10 11:09:16 -08:00
lib 31 hotfixes. 10 of these address pre-6.6 issues and are marked cc:stable. 2023-12-08 08:36:23 -08:00
LICENSES
mm mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() 2023-12-06 16:12:50 -08:00
net netfilter: nf_tables: set transport offset from mac header for netdev/egress 2023-12-20 10:43:21 +01:00
rust Kbuild updates for v6.7 2023-11-04 08:07:19 -10:00
samples Landlock updates for v6.7-rc1 2023-11-03 09:28:53 -10:00
scripts sign-file: Fix incorrect return values check 2023-12-13 12:55:11 -08:00
security + Features 2023-11-03 09:48:17 -10:00
sound ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 2023-12-07 19:21:08 +01:00
tools selftests: add vlan hw filter tests 2023-12-19 13:13:56 +01:00
usr
virt Revert "KVM: Prevent module exit until all VMs are freed" 2023-12-01 08:12:30 -08:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap mailmap: add entries for Geliang Tang 2023-12-17 20:54:22 +00:00
.rustfmt.toml
COPYING
CREDITS MAINTAINERS: drop Antti Palosaari 2023-12-06 16:12:49 -08:00
Kbuild
Kconfig
MAINTAINERS net: hns3: add new maintainer for the HNS3 ethernet driver 2023-12-19 12:43:41 +01:00
Makefile Linux 6.7-rc5 2023-12-10 14:33:40 -08:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.