Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7d80955 authored by Michael Braun's avatar Michael Braun Committed by Greg Kroah-Hartman
Browse files

netfilter: nft_reject_bridge: enable reject with bridge vlan 



commit e9c284ec4b41c827f4369973d2792992849e4fa5 upstream.

Currently, using the bridge reject target with tagged packets
results in untagged packets being sent back.

Fix this by mirroring the vlan id as well.

Fixes: 85f5b308 ("netfilter: bridge: add reject support")
Signed-off-by: default avatarMichael Braun <michael-dev@fami-braun.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 60efd2f8

net/bridge/netfilter/nft_reject_bridge.c

+6 −0
Original line number Diff line number Diff line
@@ -34,6 +34,12 @@ static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb, 
	ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);

	eth->h_proto = eth_hdr(oldskb)->h_proto;

	skb_pull(nskb, ETH_HLEN);



	if (skb_vlan_tag_present(oldskb)) {

		u16 vid = skb_vlan_tag_get(oldskb);



		__vlan_hwaccel_put_tag(nskb, oldskb->vlan_proto, vid);

	}

}



static int nft_bridge_iphdr_validate(struct sk_buff *skb)