Commit 6db5dc7b authored Apr 11, 2024 by Pablo Neira Ayuso

netfilter: flowtable: incorrect pppoe tuple



pppoe traffic reaching ingress path does not match the flowtable entry
because the pppoe header is expected to be at the network header offset.
This bug causes a mismatch in the flow table lookup, so pppoe packets
enter the classical forwarding path.

Fixes: 72efd585 ("netfilter: flowtable: add pppoe support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 87b3593b

net/netfilter/nf_flow_table_ip.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -157,7 +157,7 @@ static void nf_flow_tuple_encap(struct sk_buff *skb,
		tuple->encap[i].proto = skb->protocol;
		break;
		case htons(ETH_P_PPP_SES):
		phdr = (struct pppoe_hdr *)skb_mac_header(skb);
		phdr = (struct pppoe_hdr *)skb_network_header(skb);
		tuple->encap[i].id = ntohs(phdr->sid);
		tuple->encap[i].proto = skb->protocol;
		break;