netfilter: nft_payload: restore vlan q-in-q match support

Revert f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support").

f41f72d09ee1 ("netfilter: nft_payload: simplify vlan header handling")
already allows to match on inner vlan tags by subtract the vlan header
size to the payload offset which has been popped and stored in skbuff
metadata fields.

Fixes: f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 0a689c8e0295dfed3511997abcac53fad4b56fd5..a3cb5dbcb362cc98d96086bf7edc597f7aae6ddd 100644 (file)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -45,36 +45,27 @@ nft_payload_copy_vlan(u32 *d, const struct sk_buff *skb, u8 offset, u8 len)
        int mac_off = skb_mac_header(skb) - skb->data;
        u8 *vlanh, *dst_u8 = (u8 *) d;
        struct vlan_ethhdr veth;
-       u8 vlan_hlen = 0;
-
-       if ((skb->protocol == htons(ETH_P_8021AD) ||
-            skb->protocol == htons(ETH_P_8021Q)) &&
-           offset >= VLAN_ETH_HLEN && offset < VLAN_ETH_HLEN + VLAN_HLEN)
-               vlan_hlen += VLAN_HLEN;
 
        vlanh = (u8 *) &veth;
-       if (offset < VLAN_ETH_HLEN + vlan_hlen) {
+       if (offset < VLAN_ETH_HLEN) {
                u8 ethlen = len;
 
-               if (vlan_hlen &&
-                   skb_copy_bits(skb, mac_off, &veth, VLAN_ETH_HLEN) < 0)
-                       return false;
-               else if (!nft_payload_rebuild_vlan_hdr(skb, mac_off, &veth))
+               if (!nft_payload_rebuild_vlan_hdr(skb, mac_off, &veth))
                        return false;
 
-               if (offset + len > VLAN_ETH_HLEN + vlan_hlen)
-                       ethlen -= offset + len - VLAN_ETH_HLEN - vlan_hlen;
+               if (offset + len > VLAN_ETH_HLEN)
+                       ethlen -= offset + len - VLAN_ETH_HLEN;
 
-               memcpy(dst_u8, vlanh + offset - vlan_hlen, ethlen);
+               memcpy(dst_u8, vlanh + offset, ethlen);
 
                len -= ethlen;
                if (len == 0)
                        return true;
 
                dst_u8 += ethlen;
-               offset = ETH_HLEN + vlan_hlen;
+               offset = ETH_HLEN;
        } else {
-               offset -= VLAN_HLEN + vlan_hlen;
+               offset -= VLAN_HLEN;
        }
 
        return skb_copy_bits(skb, offset + mac_off, dst_u8, len) == 0;