netfilter: nft_reject_bridge: enable reject with bridge vlan
authorMichael Braun <michael-dev@fami-braun.de>
Wed, 6 May 2020 09:46:25 +0000 (11:46 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 25 May 2020 18:39:05 +0000 (20:39 +0200)
Currently, using the bridge reject target with tagged packets
results in untagged packets being sent back.

Fix this by mirroring the vlan id as well.

Fixes: 85f5b3086a04 ("netfilter: bridge: add reject support")
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/bridge/netfilter/nft_reject_bridge.c

index b325b56..f48cf4c 100644 (file)
@@ -31,6 +31,12 @@ static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
        ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
        eth->h_proto = eth_hdr(oldskb)->h_proto;
        skb_pull(nskb, ETH_HLEN);
+
+       if (skb_vlan_tag_present(oldskb)) {
+               u16 vid = skb_vlan_tag_get(oldskb);
+
+               __vlan_hwaccel_put_tag(nskb, oldskb->vlan_proto, vid);
+       }
 }
 
 static int nft_bridge_iphdr_validate(struct sk_buff *skb)