diff options
| author | Felix Fietkau <nbd@nbd.name> | 2021-04-10 13:20:04 +0200 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2021-04-10 16:14:34 +0200 |
| commit | f07fe36f22fcf3f3da4e0440dfc5c39516e2cb55 (patch) | |
| tree | dae926ce58c604551a2e1ac09834cae4c222ef30 /target/linux/generic/backport-5.10/610-v5.13-05-netfilter-flowtable-move-skb_try_make_writable-befor.patch | |
| parent | 012a9aa00b3e193c93600ac707dfb5bfb1bd4609 (diff) | |
| download | upstream-f07fe36f22fcf3f3da4e0440dfc5c39516e2cb55.tar.gz upstream-f07fe36f22fcf3f3da4e0440dfc5c39516e2cb55.tar.bz2 upstream-f07fe36f22fcf3f3da4e0440dfc5c39516e2cb55.zip | |
kernel: update flow offload patches to upstream version
Move patches to backport-5.10, since the series was accepted upstream
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'target/linux/generic/backport-5.10/610-v5.13-05-netfilter-flowtable-move-skb_try_make_writable-befor.patch')
| -rw-r--r-- | target/linux/generic/backport-5.10/610-v5.13-05-netfilter-flowtable-move-skb_try_make_writable-befor.patch | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/target/linux/generic/backport-5.10/610-v5.13-05-netfilter-flowtable-move-skb_try_make_writable-befor.patch b/target/linux/generic/backport-5.10/610-v5.13-05-netfilter-flowtable-move-skb_try_make_writable-befor.patch new file mode 100644 index 0000000000..84e294de7a --- /dev/null +++ b/target/linux/generic/backport-5.10/610-v5.13-05-netfilter-flowtable-move-skb_try_make_writable-befor.patch @@ -0,0 +1,35 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 23 Mar 2021 00:56:23 +0100 +Subject: [PATCH] netfilter: flowtable: move skb_try_make_writable() + before NAT in IPv4 + +For consistency with the IPv6 flowtable datapath and to make sure the +skbuff is writable right before the NAT header updates. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -266,10 +266,6 @@ nf_flow_offload_ip_hook(void *priv, stru + + iph = ip_hdr(skb); + thoff = iph->ihl * 4; +- if (skb_try_make_writable(skb, thoff + hdrsize)) +- return NF_DROP; +- +- iph = ip_hdr(skb); + if (nf_flow_state_check(flow, iph->protocol, skb, thoff)) + return NF_ACCEPT; + +@@ -280,6 +276,10 @@ nf_flow_offload_ip_hook(void *priv, stru + return NF_ACCEPT; + } + ++ if (skb_try_make_writable(skb, thoff + hdrsize)) ++ return NF_DROP; ++ ++ iph = ip_hdr(skb); + if (nf_flow_nat_ip(flow, skb, thoff, dir, iph) < 0) + return NF_DROP; + |