Florian Westphal af84f9e447 netfilter: nft_payload: rebuild vlan header on h_proto access
nft can perform merging of adjacent payload requests.
This means that:

ether saddr 00:11 ... ether type 8021ad ...

is a single payload expression, for 8 bytes, starting at the
ethernet source offset.

Check that offset+length is fully within the source/destination mac
addersses.

This bug prevents 'ether type' from matching the correct h_proto in case
vlan tag got stripped.

Fixes: de6843be3082 ("netfilter: nft_payload: rebuild vlan header when needed")
Reported-by: David Ward <david.ward@ll.mit.edu>
Signed-off-by: Florian Westphal <fw@strlen.de>
2023-10-04 14:12:01 +02:00
..
2023-05-31 13:06:57 +02:00
2023-08-29 17:39:15 -07:00
2023-08-25 18:35:09 -07:00
2023-06-24 15:41:46 -07:00
2023-08-28 06:58:46 +01:00
2023-06-28 16:43:10 -07:00
2023-08-29 17:39:15 -07:00