Patch "netfilter: bridge: add support for pppoe filtering" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: bridge: add support for pppoe filtering

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-bridge-add-support-for-pppoe-filtering.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 025dd159d2ebf40fbda287d2fdac3ebc7771f1af
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Tue Nov 23 12:50:31 2021 +0100

    netfilter: bridge: add support for pppoe filtering
    
    [ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ]
    
    This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for
    bridged traffic.
    
    Looking at the original commit it doesn't appear this ever worked:
    
     static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
    [..]
            if (skb->protocol == htons(ETH_P_8021Q)) {
                    skb_pull(skb, VLAN_HLEN);
                    skb->network_header += VLAN_HLEN;
    +       } else if (skb->protocol == htons(ETH_P_PPP_SES)) {
    +               skb_pull(skb, PPPOE_SES_HLEN);
    +               skb->network_header += PPPOE_SES_HLEN;
            }
     [..]
            NF_HOOK(... POST_ROUTING, ...)
    
    ... but the adjusted offsets are never restored.
    
    The alternative would be to rip this code out for good,
    but otoh we'd have to keep this anyway for the vlan handling
    (which works because vlan tag info is in the skb, not the packet
     payload).
    
    Reported-and-tested-by: Amish Chana <amish@xxxxxxxx>
    Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 encapsulated in pppoe traffic")
    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 2371b833b2bcd..480e4111b24c1 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -743,6 +743,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
 	if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
 		mtu = nf_bridge->frag_max_size;
 
+	nf_bridge_update_protocol(skb);
+	nf_bridge_push_encap_header(skb);
+
 	if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
 		nf_bridge_info_free(skb);
 		return br_dev_queue_push_xmit(net, sk, skb);
@@ -760,8 +763,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
 
 		IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
 
-		nf_bridge_update_protocol(skb);
-
 		data = this_cpu_ptr(&brnf_frag_data_storage);
 
 		if (skb_vlan_tag_present(skb)) {
@@ -789,8 +790,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
 
 		IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
 
-		nf_bridge_update_protocol(skb);
-
 		data = this_cpu_ptr(&brnf_frag_data_storage);
 		data->encap_size = nf_bridge_encap_header_len(skb);
 		data->size = ETH_HLEN + data->encap_size;