mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-13 19:48:16 +04:00
Mark Abe
d6933d6aed
*_pie_verify_template() rejected a template that lacked the SIP, DIP, SMAC or DMAC field a rule needs, but silently accepted one missing the L4 source/destination port or inner-VLAN fields. When such a template was picked the corresponding match was simply dropped: a "flower ip_proto udp dst_port 5353" offload installed against an L2-only template matched every UDP frame instead of just mDNS. The same gap exists identically in all four PIE-based SoCs (rtl838x, rtl839x, rtl930x, rtl931x): each verify_template() stops at the SMAC/DMAC check and never looks at the L4 port or VLAN fields. Reject a template that does not carry the port/VLAN field the rule masks, so the block search falls through to one that does. The failure was observed on an RTL9302C (Zyxel XGS1210-12, rtl930x): a dst_port 5353 drop rule also counted UDP sent to other ports. rtl838x/ 839x/931x share the same verify_template() structure and template layout, so the fix is applied there too, though only rtl930x hardware was available to reproduce and verify it. Assisted-by: Claude Code (Anthropic Claude Sonnet 5) Signed-off-by: Mark Abe <github@mab.wien> Link: https://github.com/openwrt/openwrt/pull/25024 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>