diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-05-08 23:50:34 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-06-12 12:39:53 +0300 |
| commit | 06fa4c04e844e4d662c7d8a787b420b3da281d42 (patch) | |
| tree | 192da5ce284daf8a54f52369c73c2ef56832734f /net/ipv4/netfilter/nf_tproxy_ipv4.c | |
| parent | bb581ef3971f6c2602fc0ce04137887d657e9569 (diff) | |
| download | linux-06fa4c04e844e4d662c7d8a787b420b3da281d42.tar.xz | |
netfilter: nft_payload: skbuff vlan metadata mangle support
[ Upstream commit 33c563ebf8d3deed7d8addd20d77398ac737ef9a ]
Userspace assumes vlan header is present at a given offset, but vlan
offload allows to store this in metadata fields of the skbuff. Hence
mangling vlan results in a garbled packet. Handle this transparently by
adding a parser to the kernel.
If vlan metadata is present and payload offset is over 12 bytes (source
and destination mac address fields), then subtract vlan header present
in vlan metadata, otherwise mangle vlan metadata based on offset and
length, extracting data from the source register.
This is similar to:
8cfd23e67401 ("netfilter: nft_payload: work around vlan header stripping")
to deal with vlan payload mangling.
Fixes: 7ec3f7b47b8d ("netfilter: nft_payload: add packet mangling support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/ipv4/netfilter/nf_tproxy_ipv4.c')
0 files changed, 0 insertions, 0 deletions