mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 09:20:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

net: netfilter: add ether_type to net_device_path_ctx and use it

Browse Source 
Add an ether_type field to struct net_device_path_ctx to reject IPv4
over IPv6 and vice-versa, this is currently not support. Otherwise,
incorrect dst_entry family can be reached from datapath.

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2026-08-06 23:09:06 +02:00
parent 95133a4168
commit 5592223f3d
4 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/netdevice.h
View File

@@ -941,6 +941,7 @@ struct net_device_path_stack {
struct net_device_path_ctx {
const struct net_device *dev;
u8 daddr[ETH_ALEN];
__be16 ether_type;
int num_vlans;
struct {

3
net/ipv4/ipip.c
View File

@@ -360,6 +360,9 @@ static int ipip_fill_forward_path(struct net_device_path_ctx *ctx,
const struct iphdr *tiph = &tunnel->parms.iph;
struct rtable *rt;
if (ctx->ether_type != cpu_to_be16(ETH_P_IP))
return -EOPNOTSUPP;
if (tunnel->collect_md)
return -EOPNOTSUPP;

3
net/ipv6/ip6_tunnel.c
View File

@@ -1852,6 +1852,9 @@ static int ip6_tnl_fill_forward_path(struct net_device_path_ctx *ctx,
struct flowi6 fl6;
int err;
if (ctx->ether_type != cpu_to_be16(ETH_P_IPV6))
return -EOPNOTSUPP;
if (t->parms.flags & (IP6_TNL_F_USE_ORIG_TCLASS |
IP6_TNL_F_USE_ORIG_FLOWLABEL |
IP6_TNL_F_USE_ORIG_FWMARK))

6
net/netfilter/nf_flow_table_path.c
View File

@@ -44,13 +44,15 @@ static bool nft_is_valid_ether_device(const struct net_device *dev)
static int nft_dev_fill_forward_path(const struct dst_entry *dst_cache,
const struct nf_conn *ct,
enum ip_conntrack_dir dir, u8 *ha,
enum ip_conntrack_dir dir,
u8 *ha, __be16 ether_type,
struct net_device_path_stack *stack)
{
const void *daddr = &ct->tuplehash[!dir].tuple.src.u3;
struct net_device *dev = dst_cache->dev;
struct net_device_path_ctx ctx = {
.dev = dev,
.ether_type = ether_type,
};
struct neighbour *n;
u8 nud_state;
@@ -228,7 +230,7 @@ static int nft_dev_forward_path(const struct nft_pktinfo *pkt,
unsigned char ha[ETH_ALEN];
int i;
if (nft_dev_fill_forward_path(dst, ct, dir, ha, &stack) < 0 ||
if (nft_dev_fill_forward_path(dst, ct, dir, ha, pkt->ethertype, &stack) < 0 ||
nft_dev_path_info(&stack, &info, ha, ft) < 0)
return -ENOENT;