netfilter: br_netfilter: fix recent physdev match breakage

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2189550
Upstream Status: commit 94623f5

commit 94623f5
Author: Florian Westphal <[email protected]>
Date:   Mon Apr 3 13:54:37 2023 +0200

    netfilter: br_netfilter: fix recent physdev match breakage

    Recent attempt to ensure PREROUTING hook is executed again when a
    decrypted ipsec packet received on a bridge passes through the network
    stack a second time broke the physdev match in INPUT hook.

    We can't discard the nf_bridge info strct from sabotage_in hook, as
    this is needed by the physdev match.

    Keep the struct around and handle this with another conditional instead.

    Fixes: 2b272bb ("netfilter: br_netfilter: disable sabotage_in hook after first suppression")
    Reported-and-tested-by: Farid BENAMROUCHE <[email protected]>
    Signed-off-by: Florian Westphal <[email protected]>
    Signed-off-by: Pablo Neira Ayuso <[email protected]>

Signed-off-by: Florian Westphal <[email protected]>

Author: fw-strlen

include/linux/skbuff.h

@@ -261,6 +261,7 @@ struct nf_bridge_info {
 	u8			pkt_otherhost:1;
 	u8			in_prerouting:1;
 	u8			bridged_dnat:1;
+	u8			sabotage_in_done:1;
 	__u16			frag_max_size;
 	struct net_device	*physindev;
 

net/bridge/br_netfilter_hooks.c

@@ -868,12 +868,17 @@ static unsigned int ip_sabotage_in(void *priv,
 {
 	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 
-	if (nf_bridge && !nf_bridge->in_prerouting &&
-	    !netif_is_l3_master(skb->dev) &&
-	    !netif_is_l3_slave(skb->dev)) {
-		nf_bridge_info_free(skb);
-		state->okfn(state->net, state->sk, skb);
-		return NF_STOLEN;
+	if (nf_bridge) {
+		if (nf_bridge->sabotage_in_done)
+			return NF_ACCEPT;
+
+		if (!nf_bridge->in_prerouting &&
+		    !netif_is_l3_master(skb->dev) &&
+		    !netif_is_l3_slave(skb->dev)) {
+			nf_bridge->sabotage_in_done = 1;
+			state->okfn(state->net, state->sk, skb);
+			return NF_STOLEN;
+		}
 	}
 
 	return NF_ACCEPT;