diff options
| author | Pablo Neira Ayuso | 2024-04-11 00:09:00 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso | 2024-04-11 12:14:10 +0200 |
| commit | 6db5dc7b351b9569940cd1cf445e237c42cd6d27 (patch) | |
| tree | 9bbf70319a523528a9123612ffffb4bdfeec7356 /net | |
| parent | 87b3593bed1868b2d9fe096c01bcdf0ea86cbebf (diff) | |
netfilter: flowtable: incorrect pppoe tuple
pppoe traffic reaching ingress path does not match the flowtable entry
because the pppoe header is expected to be at the network header offset.
This bug causes a mismatch in the flow table lookup, so pppoe packets
enter the classical forwarding path.
Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_flow_table_ip.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 9e9e105052da..5383bed3d3e0 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -157,7 +157,7 @@ static void nf_flow_tuple_encap(struct sk_buff *skb, tuple->encap[i].proto = skb->protocol; break; case htons(ETH_P_PPP_SES): - phdr = (struct pppoe_hdr *)skb_mac_header(skb); + phdr = (struct pppoe_hdr *)skb_network_header(skb); tuple->encap[i].id = ntohs(phdr->sid); tuple->encap[i].proto = skb->protocol; break; |