Commit f31ad71c authored by wenxu's avatar wenxu Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_flow_table_offload: check the status of dst_neigh 



It is better to get the dst_neigh with neigh->lock and check the
nud_state is VALID. If there is not neigh previous, the lookup will
Create a non NUD_VALID with 00:00:00:00:00:00 mac.

Fixes: c29f74e0 ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: default avatarwenxu <wenxu@ucloud.cn>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 1b67e506

net/netfilter/nf_flow_table_offload.c

+14 −2
Original line number Diff line number Diff line
@@ -170,8 +170,10 @@ static int flow_offload_eth_dst(struct net *net, 
	struct flow_action_entry *entry1 = flow_action_entry_next(flow_rule);

	const void *daddr = &flow->tuplehash[!dir].tuple.src_v4;

	const struct dst_entry *dst_cache;

	unsigned char ha[ETH_ALEN];

	struct neighbour *n;

	u32 mask, val;

	u8 nud_state;

	u16 val16;



	dst_cache = flow->tuplehash[dir].tuple.dst_cache;
@@ -179,13 +181,23 @@ static int flow_offload_eth_dst(struct net *net, 
	if (!n)

		return -ENOENT;



	read_lock_bh(&n->lock);

	nud_state = n->nud_state;

	ether_addr_copy(ha, n->ha);

	read_unlock_bh(&n->lock);



	if (!(nud_state & NUD_VALID)) {

		neigh_release(n);

		return -ENOENT;

	}



	mask = ~0xffffffff;

	memcpy(&val, n->ha, 4);

	memcpy(&val, ha, 4);

	flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 0,

			    &val, &mask);



	mask = ~0x0000ffff;

	memcpy(&val16, n->ha + 4, 2);

	memcpy(&val16, ha + 4, 2);

	val = val16;

	flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,

			    &val, &mask);

CRA Git | Maintained and supported by SUSTech CRA and CCSE