| From 1381a0d20eda23b8cd120c62a98fb06f688b8762 Mon Sep 17 00:00:00 2001 |
| From: Xin Long <lucien.xin@gmail.com> |
| Date: Wed, 13 Mar 2019 16:33:29 +0800 |
| Subject: netfilter: bridge: set skb transport_header before entering |
| NF_INET_PRE_ROUTING |
| |
| [ Upstream commit e166e4fdaced850bee3d5ee12a5740258fb30587 ] |
| |
| Since Commit 21d1196a35f5 ("ipv4: set transport header earlier"), |
| skb->transport_header has been always set before entering INET |
| netfilter. This patch is to set skb->transport_header for bridge |
| before entering INET netfilter by bridge-nf-call-iptables. |
| |
| It also fixes an issue that sctp_error() couldn't compute a right |
| csum due to unset skb->transport_header. |
| |
| Fixes: e6d8b64b34aa ("net: sctp: fix and consolidate SCTP checksumming code") |
| Reported-by: Li Shuang <shuali@redhat.com> |
| Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Xin Long <lucien.xin@gmail.com> |
| Acked-by: Neil Horman <nhorman@tuxdriver.com> |
| Acked-by: Florian Westphal <fw@strlen.de> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Sasha Levin (Microsoft) <sashal@kernel.org> |
| --- |
| net/bridge/br_netfilter_hooks.c | 1 + |
| net/bridge/br_netfilter_ipv6.c | 2 ++ |
| 2 files changed, 3 insertions(+) |
| |
| diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c |
| index 5fd283d9929e..89936e0d55c9 100644 |
| --- a/net/bridge/br_netfilter_hooks.c |
| +++ b/net/bridge/br_netfilter_hooks.c |
| @@ -512,6 +512,7 @@ static unsigned int br_nf_pre_routing(void *priv, |
| nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr; |
| |
| skb->protocol = htons(ETH_P_IP); |
| + skb->transport_header = skb->network_header + ip_hdr(skb)->ihl * 4; |
| |
| NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb, |
| skb->dev, NULL, |
| diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c |
| index 5811208863b7..09d5e0c7b3ba 100644 |
| --- a/net/bridge/br_netfilter_ipv6.c |
| +++ b/net/bridge/br_netfilter_ipv6.c |
| @@ -235,6 +235,8 @@ unsigned int br_nf_pre_routing_ipv6(void *priv, |
| nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; |
| |
| skb->protocol = htons(ETH_P_IPV6); |
| + skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); |
| + |
| NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, |
| skb->dev, NULL, |
| br_nf_pre_routing_finish_ipv6); |
| -- |
| 2.19.1 |
| |