iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
b4b9d2ccf0
linux/net/bridge
History
Linus Lüssing f0b4eeced5 bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries 
Ebtables on the OUTPUT chain (NF_BR_LOCAL_OUT) would not work as expected
for both locally generated IGMP and MLD queries. The IP header specific
filter options are off by 14 Bytes for netfilter (actual output on
interfaces is fine).

NF_HOOK() expects the skb->data to point to the IP header, not the
ethernet one (while dev_queue_xmit() does not). Luckily there is an
br_dev_queue_push_xmit() helper function already - let's just use that.

Introduced by eb1d164143
("bridge: Add core IGMP snooping support")

Ebtables example:

$ ebtables -I OUTPUT -p IPv6 -o eth1 --logical-out br0 \
	--log --log-level 6 --log-ip6 --log-prefix="~EBT: " -j DROP

before (broken):

~EBT:  IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
	MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
	SRC=64a4:39c2:86dd:6000:0000:0020:0001:fe80 IPv6 \
	DST=0000:0000:0000:0004:64ff:fea4:39c2:ff02, \
	IPv6 priority=0x3, Next Header=2

after (working):

~EBT:  IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
	MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
	SRC=fe80:0000:0000:0000:0004:64ff:fea4:39c2 IPv6 \
	DST=ff02:0000:0000:0000:0000:0000:0000:0001, \
	IPv6 priority=0x0, Next Header=0

Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-17 12:38:02 +01:00
..
netfilter netfilter: nft_reject_bridge: Fix powerpc build error 2014-11-03 12:12:34 -05:00
br_device.c bridge: Add filtering support for default_pvid 2014-10-05 21:21:37 -04:00
br_fdb.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-08-05 18:46:26 -07:00
br_forward.c netfilter: nft_reject_bridge: don't use IP stack to reject traffic 2014-10-31 12:50:08 +01:00
br_if.c bridge: Add filtering support for default_pvid 2014-10-05 21:21:37 -04:00
br_input.c netfilter: bridge: move br_netfilter out of the core 2014-09-26 18:42:31 +02:00
br_ioctl.c bridge: add space before '(/{', after ',', etc. 2013-12-19 19:27:26 -05:00
br_mdb.c bridge: rename struct bridge_mcast_query/querier 2014-06-10 23:50:46 -07:00
br_multicast.c bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries 2014-11-17 12:38:02 +01:00
br_netfilter.c bridge: Do not compile options in br_parse_ip_options 2014-10-24 14:24:03 +02:00
br_netlink.c net: bridge: add a br_set_state helper function 2014-10-01 22:03:50 -04:00
br_nf_core.c netfilter: bridge: move br_netfilter out of the core 2014-09-26 18:42:31 +02:00
br_private_stp.h net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
br_private.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-10-08 16:22:22 -04:00
br_stp_bpdu.c br: fix use of ->rx_handler_data in code executed on non-rx_handler path 2013-12-06 15:41:40 -05:00
br_stp_if.c net: bridge: add a br_set_state helper function 2014-10-01 22:03:50 -04:00
br_stp_timer.c net: bridge: add a br_set_state helper function 2014-10-01 22:03:50 -04:00
br_stp.c net: bridge: add a br_set_state helper function 2014-10-01 22:03:50 -04:00
br_sysfs_br.c bridge: Add a default_pvid sysfs attribute 2014-10-05 21:21:36 -04:00
br_sysfs_if.c bridge: Keep track of ports capable of automatic discovery. 2014-05-16 17:06:33 -04:00
br_vlan.c bridge: Add filtering support for default_pvid 2014-10-05 21:21:37 -04:00
br.c netfilter: bridge: move br_netfilter out of the core 2014-09-26 18:42:31 +02:00
Kconfig
Makefile netfilter: bridge: build br_nf_core only if required 2014-09-30 14:07:51 -04:00