bridge: ebtables: don't crash when using dnat target in output chains (b23c0742) · Commits · 戴 / test

xt_in() returns NULL in the output hook, skip the pkt_type change for that case, redirection only makes sense in broute/prerouting hooks. Reported-by:

Tom Yan <tom.ty89@gmail.com> Cc: Linus Lüssing <linus.luessing@c0d3.blue> Fixes: ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port") Signed-off-by:

Florian Westphal <fw@strlen.de> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/bridge/netfilter/ebt_dnat.c

+15 −4

Original line number	Diff line number	Diff line
		@@ -20,7 +20,6 @@ static unsigned int
		ebt_dnat_tg(struct sk_buff skb, const struct xt_action_param par)
		{
		const struct ebt_nat_info *info = par->targinfo;
		struct net_device *dev;

		if (skb_ensure_writable(skb, ETH_ALEN))
		return EBT_DROP;
		@@ -33,10 +32,22 @@ ebt_dnat_tg(struct sk_buff skb, const struct xt_action_param par)
		else
		skb->pkt_type = PACKET_MULTICAST;
		} else {
		if (xt_hooknum(par) != NF_BR_BROUTING)
		dev = br_port_get_rcu(xt_in(par))->br->dev;
		else
		const struct net_device *dev;

		switch (xt_hooknum(par)) {
		case NF_BR_BROUTING:
		dev = xt_in(par);
		break;
		case NF_BR_PRE_ROUTING:
		dev = br_port_get_rcu(xt_in(par))->br->dev;
		break;
		default:
		dev = NULL;
		break;
		}

		if (!dev) /* NF_BR_LOCAL_OUT */
		return info->target;

		if (ether_addr_equal(info->mac, dev->dev_addr))
		skb->pkt_type = PACKET_HOST;

Admin message