path: root/net/netfilter
diff options
authorFlorian Westphal <fw@strlen.de>2021-11-23 12:50:31 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2021-11-30 23:37:55 +0100
commit28b78ecffea8078d81466b2e01bb5a154509f1ba (patch)
tree88fcf646b03bdaa0042da12c1b53fa8bf1daa71d /net/netfilter
parentnetfilter: nft_fwd_netdev: Support egress hook (diff)
netfilter: bridge: add support for pppoe filtering
This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for bridged traffic. Looking at the original commit it doesn't appear this ever worked: static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb, [..] if (skb->protocol == htons(ETH_P_8021Q)) { skb_pull(skb, VLAN_HLEN); skb->network_header += VLAN_HLEN; + } else if (skb->protocol == htons(ETH_P_PPP_SES)) { + skb_pull(skb, PPPOE_SES_HLEN); + skb->network_header += PPPOE_SES_HLEN; } [..] NF_HOOK(... POST_ROUTING, ...) ... but the adjusted offsets are never restored. The alternative would be to rip this code out for good, but otoh we'd have to keep this anyway for the vlan handling (which works because vlan tag info is in the skb, not the packet payload). Reported-and-tested-by: Amish Chana <amish@3g.co.za> Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 encapsulated in pppoe traffic") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
0 files changed, 0 insertions, 0 deletions