From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f42.google.com (mail-ej1-f42.google.com [209.85.218.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B5B81487F4 for ; Tue, 7 Jan 2025 09:33:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736242417; cv=none; b=YY0a73/ks28VmqNGUMiy1JVEQGAYFvh6xSy7NilYInBU7INaiemj45Po2/sei58k6zQO+BCyaCpALwREdPXEdqlZnIM/+1W2W8FOROrwzMtXlYz7v21p2gHvQ2BUgUkjaiJlM5bA1ZiiJxnLiuuz6tDEWxWxYqytv7Y6dnEwWaU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736242417; c=relaxed/simple; bh=7ODgJWlOJO4/lGktleAYBsYNtDWOE8VlHBQim6ufeH0=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=iP5a8f5dYtQWzVVqY7DsFQE6fTEvcXMjVdcI7IgXUDJqdZ8uoZ5NbahIBK98ZJCoY64wZ55+HukICmtN0uzMtKszXkM9jb77j2PF983ut1q47us9dUds+7/wZdIo/hIjv8Ng1HNBIJQyfoq366rgri0GzJpN8y7+vlcIxhP4Hy8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=blackwall.org; spf=none smtp.mailfrom=blackwall.org; dkim=pass (2048-bit key) header.d=blackwall-org.20230601.gappssmtp.com header.i=@blackwall-org.20230601.gappssmtp.com header.b=WhwptH6P; arc=none smtp.client-ip=209.85.218.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=blackwall.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=blackwall.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=blackwall-org.20230601.gappssmtp.com header.i=@blackwall-org.20230601.gappssmtp.com header.b="WhwptH6P" Received: by mail-ej1-f42.google.com with SMTP id a640c23a62f3a-a9e44654ae3so2554402966b.1 for ; Tue, 07 Jan 2025 01:33:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall-org.20230601.gappssmtp.com; s=20230601; t=1736242412; x=1736847212; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=MHxjC6h0Kfucr4tH2PqzFsx9yRATfufXfuxgz/uTgy0=; b=WhwptH6P40jf+ixkyZEmYyY+pmGKqE2SunRGQun2PJv9BQHI4b621042nRZKC33Mhn G1tpDtlWBXapFGHyhMIPonM3I7LKf0qQDymnn8+nAuPaKlNFLibNh2SKxoBkHdpqBsRn e16yInB//2yrQld8Cr+4PG66wkxFTFah949EtaFSm1GzXcOXaTe5ahORApG4GSQPe9Zy Nbyq6LMA4k3cWAa0+BcBKO/ZTsvdoZyFHtLILFuYfxm2fSqisVNz8sOOsh09fkI20vM/ g+MljQeNfZuHiBUV4A7dt3S2Nu4D0KtuNR6jtbs2wOoXtu7uCr0AVXcoKcgCw9jXBmk9 2Qag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736242412; x=1736847212; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=MHxjC6h0Kfucr4tH2PqzFsx9yRATfufXfuxgz/uTgy0=; b=dMiLw/Xd9s4MPWzuSbVAyaQ/3JzTN1ft2mU5L/u68171d4AM+vAJa+HASPelPGuv1s lRJ4Fo28mZdsz7qrEGHaSizYAB2MMmPk58e/YyKAjrBrHIDCF0ngTaJf4zjmzDFiisqC nM7T7VlNS1X77sR5hm+eABJpNpAHgeUjp8E4XKp53SqsFIphgtUJQVFPsMXdxTd2Q48d dQiIMQaWulgPcyEUQyCi26uMHTni+pEBWhnHimsM99CDOCFwkn5XAlHK7VId6Ybf6GZ4 UJTa2v3M9A0w6ZpFlmJ1u6a5VBX5IpYKba0ja1IJkbrHMW1lp5URhhgfo3UrgO0+Eppf tREg== X-Forwarded-Encrypted: i=1; AJvYcCUGooqh4ya5+L7ttfFzmHa3O9mfIEegX6mOAz8no2y0sAIjojosx6vWC6p8O12wvtzs3enIFDAmOqlfblU=@vger.kernel.org X-Gm-Message-State: AOJu0YyANqumtmdq3YI+37dMFyxtds31P2sTA4xV+AL7fsQxFgBM5UmT y9aPaFMd8yHJzWZNPsseNa31B9cgZGlnaXX+wzswIEpreCd1AGtL0MN4BPYCzzM= X-Gm-Gg: ASbGncs093CbvuK8uVBj0hwUaazBTR8LYlt4Xz+4cKMhbVm2gBsVs+G7AUNG9RQYTGG XfrdxQF51nbaoou3aVWBSJhsNkZHjN19eU+WXLnZYsxKquaDFiuJCD5dmUpgrwYWqsDxeoG94im irX4yJ5uJy0FvAH7H+TPNXanurqD9SgSmAm/UtcS/wJkC0QC/HuNRUsR5/bexE+7NOCvaqP9giL WG4ZHwt/CM+g77/i+E9jRIwrczbL6u0x5fpGEYwFac6fcuw/a7ZZGH28kSRCLBhSqRVOJmajWS7 3gjh8q0sB0Ts X-Google-Smtp-Source: AGHT+IGa/DGsAatcdI0vhBgT7pEyChI9fpmymNYGz7BLnI1zVom6ss0TkBiupaXLIbc8eDhgvofItg== X-Received: by 2002:a17:907:724f:b0:aae:ebfe:cedb with SMTP id a640c23a62f3a-aaeebfecfc4mr3325114266b.51.1736242412236; Tue, 07 Jan 2025 01:33:32 -0800 (PST) Received: from [192.168.0.123] (78-154-15-142.ip.btc-net.bg. [78.154.15.142]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-aac0e895080sm2354283266b.47.2025.01.07.01.33.30 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 07 Jan 2025 01:33:31 -0800 (PST) Message-ID: <2b2488d5-8e34-429b-98f2-0ddb0cce87eb@blackwall.org> Date: Tue, 7 Jan 2025 11:33:30 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v4 net-next 02/13] netfilter: bridge: Add conntrack double vlan and pppoe To: Eric Woudstra , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn , Pablo Neira Ayuso , Jozsef Kadlecsik , Jiri Pirko , Ivan Vecera , Roopa Prabhu , Matthias Brugger , AngeloGioacchino Del Regno , David Ahern , Sebastian Andrzej Siewior , Lorenzo Bianconi , Joe Damato , Alexander Lobakin , Vladimir Oltean , Frank Wunderlich , Daniel Golle Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, bridge@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org References: <20250107090530.5035-1-ericwouds@gmail.com> <20250107090530.5035-3-ericwouds@gmail.com> Content-Language: en-US From: Nikolay Aleksandrov In-Reply-To: <20250107090530.5035-3-ericwouds@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 1/7/25 11:05, Eric Woudstra wrote: > This adds the capability to conntrack 802.1ad, QinQ, PPPoE and PPPoE-in-Q > packets that are passing a bridge. > > Signed-off-by: Eric Woudstra > --- > net/bridge/netfilter/nf_conntrack_bridge.c | 88 ++++++++++++++++++---- > 1 file changed, 75 insertions(+), 13 deletions(-) > > diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c > index 816bb0fde718..31e2bcd71735 100644 > --- a/net/bridge/netfilter/nf_conntrack_bridge.c > +++ b/net/bridge/netfilter/nf_conntrack_bridge.c > @@ -241,56 +241,118 @@ static unsigned int nf_ct_bridge_pre(void *priv, struct sk_buff *skb, > const struct nf_hook_state *state) > { > struct nf_hook_state bridge_state = *state; > + __be16 outer_proto, inner_proto; > enum ip_conntrack_info ctinfo; > + int ret, offset = 0; > struct nf_conn *ct; > - u32 len; > - int ret; > + u32 len, data_len; > > ct = nf_ct_get(skb, &ctinfo); > if ((ct && !nf_ct_is_template(ct)) || > ctinfo == IP_CT_UNTRACKED) > return NF_ACCEPT; > In all cases below I think you should make sure the headers are present in the linear part of the skb, either do pskb_may_pull() or use skb_header_pointer(). This is executed in the PRE bridge hook, so nothing has been pulled yet by it. > + switch (skb->protocol) { > + case htons(ETH_P_PPP_SES): { > + struct ppp_hdr { > + struct pppoe_hdr hdr; > + __be16 proto; > + } *ph = (struct ppp_hdr *)(skb->data); > + > + data_len = ntohs(ph->hdr.length) - 2; > + offset = PPPOE_SES_HLEN; > + outer_proto = skb->protocol; > + switch (ph->proto) { > + case htons(PPP_IP): > + inner_proto = htons(ETH_P_IP); > + break; > + case htons(PPP_IPV6): > + inner_proto = htons(ETH_P_IPV6); > + break; > + default: > + return NF_ACCEPT; > + } > + break; > + } > + case htons(ETH_P_8021Q): { > + struct vlan_hdr *vhdr = (struct vlan_hdr *)(skb->data); > + > + data_len = 0xffffffff; > + offset = VLAN_HLEN; > + outer_proto = skb->protocol; > + inner_proto = vhdr->h_vlan_encapsulated_proto; > + break; > + } > + default: > + data_len = 0xffffffff; > + break; > + } > + > + if (offset) { > + switch (inner_proto) { > + case htons(ETH_P_IP): > + case htons(ETH_P_IPV6): > + if (!pskb_may_pull(skb, offset)) > + return NF_ACCEPT; > + skb_pull_rcsum(skb, offset);> + skb_reset_network_header(skb); > + skb->protocol = inner_proto; > + break; > + default: > + return NF_ACCEPT; > + } > + } > + > + ret = NF_ACCEPT; > switch (skb->protocol) { > case htons(ETH_P_IP): > if (!pskb_may_pull(skb, sizeof(struct iphdr))) > - return NF_ACCEPT; > + goto do_not_track; > > len = skb_ip_totlen(skb); > + if (data_len < len) > + len = data_len; > if (pskb_trim_rcsum(skb, len)) > - return NF_ACCEPT; > + goto do_not_track; > > if (nf_ct_br_ip_check(skb)) > - return NF_ACCEPT; > + goto do_not_track; > > bridge_state.pf = NFPROTO_IPV4; > ret = nf_ct_br_defrag4(skb, &bridge_state); > break; > case htons(ETH_P_IPV6): > if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) > - return NF_ACCEPT; > + goto do_not_track; > > len = sizeof(struct ipv6hdr) + ntohs(ipv6_hdr(skb)->payload_len); > + if (data_len < len) > + len = data_len; > if (pskb_trim_rcsum(skb, len)) > - return NF_ACCEPT; > + goto do_not_track; > > if (nf_ct_br_ipv6_check(skb)) > - return NF_ACCEPT; > + goto do_not_track; > > bridge_state.pf = NFPROTO_IPV6; > ret = nf_ct_br_defrag6(skb, &bridge_state); > break; > default: > nf_ct_set(skb, NULL, IP_CT_UNTRACKED); > - return NF_ACCEPT; > + goto do_not_track; > } > > - if (ret != NF_ACCEPT) > - return ret; > + if (ret == NF_ACCEPT) > + ret = nf_conntrack_in(skb, &bridge_state); > > - return nf_conntrack_in(skb, &bridge_state); > +do_not_track: > + if (offset) { > + skb_push_rcsum(skb, offset); > + skb_reset_network_header(skb); > + skb->protocol = outer_proto; > + } > + return ret; > } > - > static unsigned int nf_ct_bridge_in(void *priv, struct sk_buff *skb, > const struct nf_hook_state *state) > {