Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a2bd40ad authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

netfilter 02/09: bridge: Fix handling of non-IP packets in FORWARD/POST_ROUTING 



Currently the bridge FORWARD/POST_ROUTING chains treats all
non-IPv4 packets as IPv6.  This packet fixes that by returning
NF_ACCEPT on non-IP packets instead, just as is done in PRE_ROUTING.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 88843104

net/bridge/br_netfilter.c

+8 −2
Original line number Original line Diff line number Diff line
@@ -686,8 +686,11 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb, 
	if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||

	if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||

	    IS_PPPOE_IP(skb))

	    IS_PPPOE_IP(skb))

		pf = PF_INET;

		pf = PF_INET;

	else

	else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||

		 IS_PPPOE_IPV6(skb))

		pf = PF_INET6;

		pf = PF_INET6;

	else

		return NF_ACCEPT;





	nf_bridge_pull_encap_header(skb);

	nf_bridge_pull_encap_header(skb);
@@ -828,8 +831,11 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb, 
	if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||

	if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||

	    IS_PPPOE_IP(skb))

	    IS_PPPOE_IP(skb))

		pf = PF_INET;

		pf = PF_INET;

	else

	else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||

		 IS_PPPOE_IPV6(skb))

		pf = PF_INET6;

		pf = PF_INET6;

	else

		return NF_ACCEPT;





#ifdef CONFIG_NETFILTER_DEBUG

#ifdef CONFIG_NETFILTER_DEBUG

	if (skb->dst == NULL) {

	if (skb->dst == NULL) {