netdev - Re: [PATCH net 4/6] netfilter: nft_payload: skbuff vlan metadata mangle support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Zk9c6TfO6_BRvbkN@calendula>
Date: Thu, 23 May 2024 17:12:41 +0200
From: Pablo Neira Ayuso <pablo@...filter.org>
To: Paolo Abeni <pabeni@...hat.com>
Cc: netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org, kuba@...nel.org, edumazet@...gle.com,
	fw@...len.de
Subject: Re: [PATCH net 4/6] netfilter: nft_payload: skbuff vlan metadata
 mangle support

On Thu, May 23, 2024 at 11:26:45AM +0200, Paolo Abeni wrote:
> On Thu, 2024-05-23 at 01:13 +0200, Pablo Neira Ayuso wrote:
> > @@ -801,21 +801,79 @@ struct nft_payload_set {
> >  	u8			csum_flags;
> >  };
> >  
> > +/* This is not struct vlan_hdr. */
> > +struct nft_payload_vlan_hdr {
> > +        __be16          h_vlan_proto;
> > +        __be16          h_vlan_TCI;
> > +};
> > +
> > +static bool
> > +nft_payload_set_vlan(const u32 *src, struct sk_buff *skb, u8 offset, u8 len,
> > +		     int *vlan_hlen)
> > +{
> > +	struct nft_payload_vlan_hdr *vlanh;
> > +	__be16 vlan_proto;
> > +	__be16 vlan_tci;
> > +
> > +	if (offset >= offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto)) {
> > +		*vlan_hlen = VLAN_HLEN;
> > +		return true;
> > +	}
> > +
> > +	switch (offset) {
> > +	case offsetof(struct vlan_ethhdr, h_vlan_proto):
> > +		if (len == 2) {
> > +			vlan_proto = nft_reg_load16(src);
> 
> I'm sorry but the above introduces build warning due to endianess
> mismatch (host -> be)
> 
> > +			skb->vlan_proto = vlan_proto;
> > +		} else if (len == 4) {
> > +			vlanh = (struct nft_payload_vlan_hdr *)src;
> > +			__vlan_hwaccel_put_tag(skb, vlanh->h_vlan_proto,
> > +					       ntohs(vlanh->h_vlan_TCI));
> > +		} else {
> > +			return false;
> > +		}
> > +		break;
> > +	case offsetof(struct vlan_ethhdr, h_vlan_TCI):
> > +		if (len != 2)
> > +			return false;
> > +
> > +		vlan_tci = ntohs(nft_reg_load16(src));
> 
> Similar things here htons() expect a be short int and is receiving a
> u16, vlan_tci is 'be' and the assigned data uses host endianess.
> 
> 
> Could you please address the above?

Sure, I will post v2.