2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-23 12:43:55 +08:00
linux-next/net/bridge
David Ahern a173f066c7 netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev
For starters, the bridge netfilter code registers operations that
are invoked any time nh_hook is called. Specifically, ip_sabotage_in
watches for nested calls for NF_INET_PRE_ROUTING when a bridge is in
the stack.

Packet wise, the bridge netfilter hook runs first. br_nf_pre_routing
allocates nf_bridge, sets in_prerouting to 1 and calls NF_HOOK for
NF_INET_PRE_ROUTING. It's finish function, br_nf_pre_routing_finish,
then resets in_prerouting flag to 0 and the packet continues up the
stack. The packet eventually makes it to the VRF driver and it invokes
nf_hook for NF_INET_PRE_ROUTING in case any rules have been added against
the vrf device.

Because of the registered operations the call to nf_hook causes
ip_sabotage_in to be invoked. That function sees the nf_bridge on the
skb and that in_prerouting is not set. Thinking it is an invalid nested
call it steals (drops) the packet.

Update ip_sabotage_in to recognize that the bridge or one of its upper
devices (e.g., vlan) can be enslaved to a VRF (L3 master device) and
allow the packet to go through the nf_hook a second time.

Fixes: 73e20b761a ("net: vrf: Add support for PREROUTING rules on vrf device")
Reported-by: D'Souza, Nelson <ndsouza@ciena.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-09-20 18:24:14 +02:00
..
netfilter netfilter: bridge: Expose nf_tables bridge hook priorities through uapi 2018-08-03 21:15:09 +02:00
br_arp_nd_proxy.c bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports 2017-10-08 21:12:04 -07:00
br_device.c net: bridge: disable bridge MTU auto tuning if it was set manually 2018-03-31 22:19:00 -04:00
br_fdb.c net: bridge: Fix locking in br_fdb_find_port() 2018-06-08 19:58:31 -04:00
br_forward.c net: bridge: add support for backup port 2018-07-23 09:32:15 -07:00
br_if.c net: bridge: add support for backup port 2018-07-23 09:32:15 -07:00
br_input.c net: bridge: add support for port isolation 2018-05-25 14:37:20 -04:00
br_ioctl.c net: bridge: add notifications for the bridge dev on vlan change 2017-11-02 15:53:40 +09:00
br_mdb.c net: use rtnl_register_module where needed 2017-12-04 11:32:39 -05:00
br_multicast.c net/bridge/br_multicast: remove redundant variable "err" 2018-08-06 10:33:44 -07:00
br_netfilter_hooks.c netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev 2018-09-20 18:24:14 +02:00
br_netfilter_ipv6.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
br_netlink_tunnel.c bridge: netlink: make setlink/dellink notifications more accurate 2017-10-29 11:03:43 +09:00
br_netlink.c net: bridge: add support for backup port 2018-07-23 09:32:15 -07:00
br_nf_core.c xfrm: Move dst->path into struct xfrm_dst 2017-11-30 09:54:26 -05:00
br_private_stp.h net: bridge: add helper to set topology change 2016-12-10 21:27:23 -05:00
br_private_tunnel.h bridge: netlink: make setlink/dellink notifications more accurate 2017-10-29 11:03:43 +09:00
br_private.h net: bridge: add support for backup port 2018-07-23 09:32:15 -07:00
br_stp_bpdu.c net: introduce __skb_put_[zero, data, u8] 2017-06-20 13:30:14 -04:00
br_stp_if.c net: bridge: add notifications for the bridge dev on vlan change 2017-11-02 15:53:40 +09:00
br_stp_timer.c net: bridge: Convert timers to use timer_setup() 2017-11-03 15:42:49 +09:00
br_stp.c net: bridge: add notifications for the bridge dev on vlan change 2017-11-02 15:53:40 +09:00
br_switchdev.c net: bridge: Extract boilerplate around switchdev_port_obj_*() 2018-05-31 14:13:42 -04:00
br_sysfs_br.c net: Use octal not symbolic permissions 2018-03-26 12:07:48 -04:00
br_sysfs_if.c net: bridge: add support for backup port 2018-07-23 09:32:15 -07:00
br_vlan_tunnel.c bridge: vlan_tunnel: explicitly reset metadata attrs to NULL on failure 2017-02-17 13:33:41 -05:00
br_vlan.c net: bridge: Notify about bridge VLANs 2018-05-31 14:13:44 -04:00
br.c net: bridge: Notify about !added_by_user FDB entries 2018-05-03 13:46:47 -04:00
Kconfig bridge: Add vlan filtering infrastructure 2013-02-13 19:41:46 -05:00
Makefile Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00