netfilter: br_netfilter: fix recent physdev match breakage

Recent attempt to ensure PREROUTING hook is executed again when a
decrypted ipsec packet received on a bridge passes through the network
stack a second time broke the physdev match in INPUT hook.

We can't discard the nf_bridge info strct from sabotage_in hook, as
this is needed by the physdev match.

Keep the struct around and handle this with another conditional instead.

Fixes: 2b272bb558f1 ("netfilter: br_netfilter: disable sabotage_in hook after first suppression")
Reported-and-tested-by: Farid BENAMROUCHE <fariouche@yahoo.fr>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index ff7ad33..1ec3530 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -294,6 +294,7 @@ struct nf_bridge_info {
        u8                      pkt_otherhost:1;
        u8                      in_prerouting:1;
        u8                      bridged_dnat:1;
+       u8                      sabotage_in_done:1;
        __u16                   frag_max_size;
        struct net_device       *physindev;
 

diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 638a4d5..4bc6761 100644 (file)
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -868,12 +868,17 @@ static unsigned int ip_sabotage_in(void *priv,
 {
        struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 
-       if (nf_bridge && !nf_bridge->in_prerouting &&
-           !netif_is_l3_master(skb->dev) &&
-           !netif_is_l3_slave(skb->dev)) {
-               nf_bridge_info_free(skb);
-               state->okfn(state->net, state->sk, skb);
-               return NF_STOLEN;
+       if (nf_bridge) {
+               if (nf_bridge->sabotage_in_done)
+                       return NF_ACCEPT;
+
+               if (!nf_bridge->in_prerouting &&
+                   !netif_is_l3_master(skb->dev) &&
+                   !netif_is_l3_slave(skb->dev)) {
+                       nf_bridge->sabotage_in_done = 1;
+                       state->okfn(state->net, state->sk, skb);
+                       return NF_STOLEN;
+               }
        }
 
        return NF_ACCEPT;