-
Notifications
You must be signed in to change notification settings - Fork 153
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'op/main'
- Loading branch information
Showing
267 changed files
with
3,935 additions
and
48,515 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
85 changes: 85 additions & 0 deletions
85
...t/linux/generic/backport-5.15/741-v6.9-01-netfilter-flowtable-validate-pppoe-header.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| From: Pablo Neira Ayuso <pablo@netfilter.org> | ||
| Date: Thu, 11 Apr 2024 13:28:59 +0200 | ||
| Subject: [PATCH] netfilter: flowtable: validate pppoe header | ||
|
|
||
| Ensure there is sufficient room to access the protocol field of the | ||
| PPPoe header. Validate it once before the flowtable lookup, then use a | ||
| helper function to access protocol field. | ||
|
|
||
| Reported-by: syzbot+b6f07e1c07ef40199081@syzkaller.appspotmail.com | ||
| Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support") | ||
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> | ||
| --- | ||
|
|
||
| --- a/include/net/netfilter/nf_flow_table.h | ||
| +++ b/include/net/netfilter/nf_flow_table.h | ||
| @@ -318,7 +318,7 @@ int nf_flow_rule_route_ipv6(struct net * | ||
| int nf_flow_table_offload_init(void); | ||
| void nf_flow_table_offload_exit(void); | ||
|
|
||
| -static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb) | ||
| +static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb) | ||
| { | ||
| __be16 proto; | ||
|
|
||
| @@ -334,4 +334,14 @@ static inline __be16 nf_flow_pppoe_proto | ||
| return 0; | ||
| } | ||
|
|
||
| +static inline bool nf_flow_pppoe_proto(struct sk_buff *skb, __be16 *inner_proto) | ||
| +{ | ||
| + if (!pskb_may_pull(skb, PPPOE_SES_HLEN)) | ||
| + return false; | ||
| + | ||
| + *inner_proto = __nf_flow_pppoe_proto(skb); | ||
| + | ||
| + return true; | ||
| +} | ||
| + | ||
| #endif /* _NF_FLOW_TABLE_H */ | ||
| --- a/net/netfilter/nf_flow_table_inet.c | ||
| +++ b/net/netfilter/nf_flow_table_inet.c | ||
| @@ -21,7 +21,8 @@ nf_flow_offload_inet_hook(void *priv, st | ||
| proto = veth->h_vlan_encapsulated_proto; | ||
| break; | ||
| case htons(ETH_P_PPP_SES): | ||
| - proto = nf_flow_pppoe_proto(skb); | ||
| + if (!nf_flow_pppoe_proto(skb, &proto)) | ||
| + return NF_ACCEPT; | ||
| break; | ||
| default: | ||
| proto = skb->protocol; | ||
| --- a/net/netfilter/nf_flow_table_ip.c | ||
| +++ b/net/netfilter/nf_flow_table_ip.c | ||
| @@ -246,10 +246,11 @@ static unsigned int nf_flow_xmit_xfrm(st | ||
| return NF_STOLEN; | ||
| } | ||
|
|
||
| -static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto, | ||
| +static bool nf_flow_skb_encap_protocol(struct sk_buff *skb, __be16 proto, | ||
| u32 *offset) | ||
| { | ||
| struct vlan_ethhdr *veth; | ||
| + __be16 inner_proto; | ||
|
|
||
| switch (skb->protocol) { | ||
| case htons(ETH_P_8021Q): | ||
| @@ -260,7 +261,8 @@ static bool nf_flow_skb_encap_protocol(c | ||
| } | ||
| break; | ||
| case htons(ETH_P_PPP_SES): | ||
| - if (nf_flow_pppoe_proto(skb) == proto) { | ||
| + if (nf_flow_pppoe_proto(skb, &inner_proto) && | ||
| + inner_proto == proto) { | ||
| *offset += PPPOE_SES_HLEN; | ||
| return true; | ||
| } | ||
| @@ -289,7 +291,7 @@ static void nf_flow_encap_pop(struct sk_ | ||
| skb_reset_network_header(skb); | ||
| break; | ||
| case htons(ETH_P_PPP_SES): | ||
| - skb->protocol = nf_flow_pppoe_proto(skb); | ||
| + skb->protocol = __nf_flow_pppoe_proto(skb); | ||
| skb_pull(skb, PPPOE_SES_HLEN); | ||
| skb_reset_network_header(skb); | ||
| break; |
24 changes: 24 additions & 0 deletions
24
...t/linux/generic/backport-5.15/741-v6.9-02-netfilter-flowtable-incorrect-pppoe-tuple.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| From: Pablo Neira Ayuso <pablo@netfilter.org> | ||
| Date: Thu, 11 Apr 2024 13:29:00 +0200 | ||
| Subject: [PATCH] netfilter: flowtable: incorrect pppoe tuple | ||
|
|
||
| pppoe traffic reaching ingress path does not match the flowtable entry | ||
| because the pppoe header is expected to be at the network header offset. | ||
| This bug causes a mismatch in the flow table lookup, so pppoe packets | ||
| enter the classical forwarding path. | ||
|
|
||
| Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support") | ||
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> | ||
| --- | ||
|
|
||
| --- a/net/netfilter/nf_flow_table_ip.c | ||
| +++ b/net/netfilter/nf_flow_table_ip.c | ||
| @@ -156,7 +156,7 @@ static void nf_flow_tuple_encap(struct s | ||
| tuple->encap[i].proto = skb->protocol; | ||
| break; | ||
| case htons(ETH_P_PPP_SES): | ||
| - phdr = (struct pppoe_hdr *)skb_mac_header(skb); | ||
| + phdr = (struct pppoe_hdr *)skb_network_header(skb); | ||
| tuple->encap[i].id = ntohs(phdr->sid); | ||
| tuple->encap[i].proto = skb->protocol; | ||
| break; |
Oops, something went wrong.