Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4b7fd5d9 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: explicit module dependency between br_netfilter and physdev 



You can use physdev to match the physical interface enslaved to the
bridge device. This information is stored in skb->nf_bridge and it is
set up by br_netfilter. So, this is only available when iptables is
used from the bridge netfilter path.

Since 34666d46 ("netfilter: bridge: move br_netfilter out of the core"),
the br_netfilter code is modular. To reduce the impact of this change,
we can autoload the br_netfilter if the physdev match is used since
we assume that the users need br_netfilter in place.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 36d2af59

include/net/netfilter/br_netfilter.h

0 → 100644
+6 −0
Original line number Diff line number Diff line 
#ifndef _BR_NETFILTER_H_

#define _BR_NETFILTER_H_



void br_netfilter_enable(void);



#endif /* _BR_NETFILTER_H_ */

net/bridge/br_netfilter.c

+5 −0
Original line number Diff line number Diff line
@@ -856,6 +856,11 @@ static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops, 
	return NF_ACCEPT;

}



void br_netfilter_enable(void)

{

}

EXPORT_SYMBOL_GPL(br_netfilter_enable);



/* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because

 * br_dev_queue_push_xmit is called afterwards */

static struct nf_hook_ops br_nf_ops[] __read_mostly = {

net/netfilter/xt_physdev.c

+3 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
#include <linux/netfilter_bridge.h>

#include <linux/netfilter/xt_physdev.h>

#include <linux/netfilter/x_tables.h>

#include <net/netfilter/br_netfilter.h>



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
@@ -87,6 +88,8 @@ static int physdev_mt_check(const struct xt_mtchk_param *par) 
{

	const struct xt_physdev_info *info = par->matchinfo;



	br_netfilter_enable();



	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||

	    info->bitmask & ~XT_PHYSDEV_OP_MASK)

		return -EINVAL;