linux-stable/net/bridge
Florian Westphal 54b5ab456e netfilter: bridge: add support for pppoe filtering
[ Upstream commit 28b78ecffe ]

This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for
bridged traffic.

Looking at the original commit it doesn't appear this ever worked:

 static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
[..]
        if (skb->protocol == htons(ETH_P_8021Q)) {
                skb_pull(skb, VLAN_HLEN);
                skb->network_header += VLAN_HLEN;
+       } else if (skb->protocol == htons(ETH_P_PPP_SES)) {
+               skb_pull(skb, PPPOE_SES_HLEN);
+               skb->network_header += PPPOE_SES_HLEN;
        }
 [..]
	NF_HOOK(... POST_ROUTING, ...)

... but the adjusted offsets are never restored.

The alternative would be to rip this code out for good,
but otoh we'd have to keep this anyway for the vlan handling
(which works because vlan tag info is in the skb, not the packet
 payload).

Reported-and-tested-by: Amish Chana <amish@3g.co.za>
Fixes: 516299d2f5 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 encapsulated in pppoe traffic")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 09:19:31 +01:00
..
netfilter netfilter: nf_conntrack_bridge: Fix memory leak when error 2021-08-18 08:56:58 +02:00
br.c net: bridge: Fix a warning when del bridge sysfs 2021-02-23 15:02:25 +01:00
br_arp_nd_proxy.c net: bridge: when suppression is enabled exclude RARP packets 2021-05-19 10:08:21 +02:00
br_device.c bridge: Fix a deadlock when enabling multicast snooping 2020-12-21 13:27:04 +01:00
br_fdb.c
br_forward.c
br_if.c net: bridge: fix memleak in br_add_if() 2021-08-18 08:57:00 +02:00
br_input.c
br_ioctl.c
br_mdb.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-09-15 14:17:27 +02:00
br_multicast.c net: bridge: mcast: fix broken length + header check for MRDv6 Adv. 2021-05-14 09:44:32 +02:00
br_netfilter_hooks.c netfilter: bridge: add support for pppoe filtering 2022-01-27 09:19:31 +01:00
br_netfilter_ipv6.c
br_netlink.c net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() 2021-10-13 10:08:19 +02:00
br_netlink_tunnel.c
br_nf_core.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2020-01-04 19:18:58 +01:00
br_private.h net: bridge: fix vlan tunnel dst null pointer dereference 2021-06-23 14:41:30 +02:00
br_private_stp.h
br_private_tunnel.h
br_stp.c
br_stp_bpdu.c
br_stp_if.c
br_stp_timer.c
br_switchdev.c
br_sysfs_br.c
br_sysfs_if.c net: bridge: use switchdev for port flags set through sysfs too 2021-03-07 12:20:43 +01:00
br_vlan.c net: bridge: vlan: fix error return code in __vlan_add() 2020-12-21 13:27:03 +01:00
br_vlan_tunnel.c net: bridge: fix vlan tunnel dst refcnt when egressing 2021-06-23 14:41:30 +02:00
Kconfig
Makefile