Received: with ECARTIS (v1.0.0; list netdev); Thu, 30 Dec 2004 10:44:14 -0800 (PST) Received: from poros.telenet-ops.be (poros.telenet-ops.be [195.130.132.44]) by oss.sgi.com (8.13.0/8.13.0) with ESMTP id iBUIhl5i028506 for ; Thu, 30 Dec 2004 10:44:08 -0800 Received: from localhost (localhost.localdomain [127.0.0.1]) by poros.telenet-ops.be (Postfix) with SMTP id 7DF743BC159; Thu, 30 Dec 2004 19:50:56 +0100 (MET) Received: from 192.168.0.138 (D5763CA9.kabel.telenet.be [213.118.60.169]) by poros.telenet-ops.be (Postfix) with ESMTP id 37E243BC185; Thu, 30 Dec 2004 19:50:56 +0100 (MET) Subject: [PATCH][BRIDGE-NF] Fix wrong use of skb->protocol From: Bart De Schuymer To: "David S. Miller" Cc: netdev@oss.sgi.com Content-Type: text/plain Date: Thu, 30 Dec 2004 19:55:14 +0100 Message-Id: <1104432914.15601.19.camel@localhost.localdomain> Mime-Version: 1.0 X-Mailer: Evolution 2.0.2 (2.0.2-3) Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.80/638/Tue Dec 21 14:41:34 2004 clamav-milter version 0.80j on 127.0.0.1 X-Virus-Status: Clean X-archive-position: 13255 X-ecartis-version: Ecartis v1.0.0 Sender: netdev-bounce@oss.sgi.com Errors-to: netdev-bounce@oss.sgi.com X-original-sender: bdschuym@pandora.be Precedence: bulk X-list: netdev Hi Dave, ip_sabotage_out() needs to distinguish IPv4 and IPv6 traffic. It currently does that by looking at skb->protocol. However, for locally originated packets, skb->protocol is not initialized. The patch below instead looks at the version number of the packet's data, which should be 4 or 6. Thanks to Pasha (Crazy AMD K7 ) for his patience. Signed-off-by: Bart De Schuymer --- linux-2.6.10/net/bridge/br_netfilter.c.old 2004-12-30 15:34:11.000000000 +0100 +++ linux-2.6.10/net/bridge/br_netfilter.c 2004-12-30 19:13:31.000000000 +0100 @@ -845,19 +845,6 @@ static unsigned int ip_sabotage_out(unsi { struct sk_buff *skb = *pskb; -#ifdef CONFIG_SYSCTL - if (!skb->nf_bridge) { - struct vlan_ethhdr *hdr = vlan_eth_hdr(skb); - - if (skb->protocol == __constant_htons(ETH_P_IP) || - IS_VLAN_IP) { - if (!brnf_call_iptables) - return NF_ACCEPT; - } else if (!brnf_call_ip6tables) - return NF_ACCEPT; - } -#endif - if ((out->hard_start_xmit == br_dev_xmit && okfn != br_nf_forward_finish && okfn != br_nf_local_out_finish && @@ -869,8 +856,24 @@ static unsigned int ip_sabotage_out(unsi ) { struct nf_bridge_info *nf_bridge; - if (!skb->nf_bridge && !nf_bridge_alloc(skb)) - return NF_DROP; + if (!skb->nf_bridge) { +#ifdef CONFIG_SYSCTL + /* This code is executed while in the IP(v6) stack, + the version should be 4 or 6. We can't use + skb->protocol because that isn't set on + PF_INET(6)/LOCAL_OUT. */ + struct iphdr *ip = skb->nh.iph; + + if (ip->version == 4 && !brnf_call_iptables) + return NF_ACCEPT; + else if (ip->version == 6 && !brnf_call_ip6tables) + return NF_ACCEPT; +#endif + if (hook == NF_IP_POST_ROUTING) + return NF_ACCEPT; + if (!nf_bridge_alloc(skb)) + return NF_DROP; + } nf_bridge = skb->nf_bridge;