ramips: add support for mqmaker witi 512mb version
[openwrt/openwrt.git] / target / linux / generic / backport-4.14 / 367-netfilter-nf_flow_table-add-missing-condition-for-TC.patch
1 From: Felix Fietkau <nbd@nbd.name>
2 Date: Fri, 23 Mar 2018 17:15:22 +0100
3 Subject: [PATCH] netfilter: nf_flow_table: add missing condition for TCP state
4 check
5
6 Avoid looking at unrelated fields in UDP packets
7
8 Signed-off-by: Felix Fietkau <nbd@nbd.name>
9 ---
10
11 --- a/net/netfilter/nf_flow_table_ip.c
12 +++ b/net/netfilter/nf_flow_table_ip.c
13 @@ -15,11 +15,14 @@
14 #include <linux/tcp.h>
15 #include <linux/udp.h>
16
17 -static int nf_flow_tcp_state_check(struct flow_offload *flow,
18 - struct sk_buff *skb, unsigned int thoff)
19 +static int nf_flow_state_check(struct flow_offload *flow, int proto,
20 + struct sk_buff *skb, unsigned int thoff)
21 {
22 struct tcphdr *tcph;
23
24 + if (proto != IPPROTO_TCP)
25 + return 0;
26 +
27 if (!pskb_may_pull(skb, thoff + sizeof(*tcph)))
28 return -1;
29
30 @@ -248,7 +251,7 @@ nf_flow_offload_ip_hook(void *priv, stru
31 return NF_DROP;
32
33 thoff = ip_hdr(skb)->ihl * 4;
34 - if (nf_flow_tcp_state_check(flow, skb, thoff))
35 + if (nf_flow_state_check(flow, ip_hdr(skb)->protocol, skb, thoff))
36 return NF_ACCEPT;
37
38 if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
39 @@ -460,7 +463,8 @@ nf_flow_offload_ipv6_hook(void *priv, st
40 if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
41 return NF_ACCEPT;
42
43 - if (nf_flow_tcp_state_check(flow, skb, sizeof(*ip6h)))
44 + if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb,
45 + sizeof(*ip6h)))
46 return NF_ACCEPT;
47
48 if (skb_try_make_writable(skb, sizeof(*ip6h)))