Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 10ea6ac8 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NETFILTER]: bridge netfilter: add deferred output hooks to feature-removal-schedule 



Add bridge netfilter deferred output hooks to feature-removal-schedule
and disable them by default. Until their removal they will be
activated by the physdev match when needed.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 28658c89

Documentation/feature-removal-schedule.txt

+16 −0
Original line number Diff line number Diff line
@@ -258,3 +258,19 @@ Why: These drivers never compiled since they were added to the kernel 
Who:	Jean Delvare <khali@linux-fr.org>



---------------------------



What:	Bridge netfilter deferred IPv4/IPv6 output hook calling

When:	January 2007

Why:	The deferred output hooks are a layering violation causing unusual

	and broken behaviour on bridge devices. Examples of things they

	break include QoS classifation using the MARK or CLASSIFY targets,

	the IPsec policy match and connection tracking with VLANs on a

	bridge. Their only use is to enable bridge output port filtering

	within iptables with the physdev match, which can also be done by

	combining iptables and ebtables using netfilter marks. Until it

	will get removed the hook deferral is disabled by default and is

	only enabled when needed.



Who:	Patrick McHardy <kaber@trash.net>



---------------------------

include/linux/netfilter_bridge.h

+2 −0
Original line number Diff line number Diff line
@@ -79,6 +79,8 @@ struct bridge_skb_cb { 
		__u32 ipv4;

	} daddr;

};



extern int brnf_deferred_hooks;

#endif /* CONFIG_BRIDGE_NETFILTER */



#endif /* __KERNEL__ */

net/bridge/br_netfilter.c

+5 −0
Original line number Diff line number Diff line
@@ -61,6 +61,9 @@ static int brnf_filter_vlan_tagged = 1; 
#define brnf_filter_vlan_tagged 1

#endif



int brnf_deferred_hooks;

EXPORT_SYMBOL_GPL(brnf_deferred_hooks);



static __be16 inline vlan_proto(const struct sk_buff *skb)

{

	return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
@@ -890,6 +893,8 @@ static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb, 
				return NF_ACCEPT;

			else if (ip->version == 6 && !brnf_call_ip6tables)

				return NF_ACCEPT;

			else if (!brnf_deferred_hooks)

				return NF_ACCEPT;

#endif

			if (hook == NF_IP_POST_ROUTING)

				return NF_ACCEPT;

net/netfilter/xt_physdev.c

+15 −0
Original line number Diff line number Diff line
@@ -113,6 +113,21 @@ checkentry(const char *tablename, 
	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||

	    info->bitmask & ~XT_PHYSDEV_OP_MASK)

		return 0;

	if (brnf_deferred_hooks == 0 &&

	    info->bitmask & XT_PHYSDEV_OP_OUT &&

	    (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||

	     info->invert & XT_PHYSDEV_OP_BRIDGED) &&

	    hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |

	                 (1 << NF_IP_POST_ROUTING))) {

		printk(KERN_WARNING "physdev match: using --physdev-out in the "

		       "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "

		       "traffic is deprecated and breaks other things, it will "

		       "be removed in January 2007. See Documentation/"

		       "feature-removal-schedule.txt for details. This doesn't "

		       "affect you in case you're using it for purely bridged "

		       "traffic.\n");

		brnf_deferred_hooks = 1;

	}

	return 1;

}