From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B476019E7FF; Thu, 6 Jun 2024 14:19:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717683542; cv=none; b=QMlq8bTGDjZFD+zb+ZCusBMBzsgUt/wD4x/6yI2snatxca9RWZ53cJhSQX2kNqC0fHt3byhc3nhrMU3RB8+GkoIl7k17hRNQDz+OkmO19hrS/60qk6o5jmeKJzmPAtCJnz1rLOkiExc5uRv0fLf08+VC7RVQCxz1mBQUeeY9mAw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717683542; c=relaxed/simple; bh=AFNPBt5EYgUO9I5Wen26gAcdnLfSuY7+GxzD5r56+hk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KfKby1wiBV/lF9NERCpTt1X6rkWK9m9dtVptXMPdQxBNghE+0MdhVj1iH81hg4HiiwortooKy1/uM1B91JKrPqxrOXbSHcLVu+JffNJPfl0BxnqaslNSVXj1n8qA1R+AqHLFnUWsJ223nY4xEbCWkN1z3V9836p9jkmNdLkdlNI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=H+LF6gKV; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="H+LF6gKV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 96395C32781; Thu, 6 Jun 2024 14:19:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1717683542; bh=AFNPBt5EYgUO9I5Wen26gAcdnLfSuY7+GxzD5r56+hk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=H+LF6gKVzaJicUuHbTQfOXYxfs+ZASBSotBPggiDn4g20zA/dYYIRVpb0Y18wRJVy SC0QzPbxoLAQTv3KnqGAHQ3GVEy5pQJOgrP+FCbT3J/zUx2EBMEN+aaJL/JEfrVg8k HwS5SAbCnyfcYtGjl2Crc/zndeukkHA7n1sqn58c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 6.1 432/473] netfilter: nft_payload: restore vlan q-in-q match support Date: Thu, 6 Jun 2024 16:06:01 +0200 Message-ID: <20240606131714.028053966@linuxfoundation.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240606131659.786180261@linuxfoundation.org> References: <20240606131659.786180261@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pablo Neira Ayuso [ Upstream commit aff5c01fa1284d606f8e7cbdaafeef2511bb46c1 ] Revert f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support"). f41f72d09ee1 ("netfilter: nft_payload: simplify vlan header handling") already allows to match on inner vlan tags by subtract the vlan header size to the payload offset which has been popped and stored in skbuff metadata fields. Fixes: f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nft_payload.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c index f44f2eaf32172..70d8d87848fc0 100644 --- a/net/netfilter/nft_payload.c +++ b/net/netfilter/nft_payload.c @@ -44,36 +44,27 @@ nft_payload_copy_vlan(u32 *d, const struct sk_buff *skb, u8 offset, u8 len) int mac_off = skb_mac_header(skb) - skb->data; u8 *vlanh, *dst_u8 = (u8 *) d; struct vlan_ethhdr veth; - u8 vlan_hlen = 0; - - if ((skb->protocol == htons(ETH_P_8021AD) || - skb->protocol == htons(ETH_P_8021Q)) && - offset >= VLAN_ETH_HLEN && offset < VLAN_ETH_HLEN + VLAN_HLEN) - vlan_hlen += VLAN_HLEN; vlanh = (u8 *) &veth; - if (offset < VLAN_ETH_HLEN + vlan_hlen) { + if (offset < VLAN_ETH_HLEN) { u8 ethlen = len; - if (vlan_hlen && - skb_copy_bits(skb, mac_off, &veth, VLAN_ETH_HLEN) < 0) - return false; - else if (!nft_payload_rebuild_vlan_hdr(skb, mac_off, &veth)) + if (!nft_payload_rebuild_vlan_hdr(skb, mac_off, &veth)) return false; - if (offset + len > VLAN_ETH_HLEN + vlan_hlen) - ethlen -= offset + len - VLAN_ETH_HLEN - vlan_hlen; + if (offset + len > VLAN_ETH_HLEN) + ethlen -= offset + len - VLAN_ETH_HLEN; - memcpy(dst_u8, vlanh + offset - vlan_hlen, ethlen); + memcpy(dst_u8, vlanh + offset, ethlen); len -= ethlen; if (len == 0) return true; dst_u8 += ethlen; - offset = ETH_HLEN + vlan_hlen; + offset = ETH_HLEN; } else { - offset -= VLAN_HLEN + vlan_hlen; + offset -= VLAN_HLEN; } return skb_copy_bits(skb, offset + mac_off, dst_u8, len) == 0; -- 2.43.0