* [PATCH net] netfilter: bridge: Don't sabotage nf_hook calls for an l3mdev slave
@ 2019-02-26 0:21 David Ahern
2019-03-01 13:33 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: David Ahern @ 2019-02-26 0:21 UTC (permalink / raw)
To: pablo; +Cc: netdev, netfilter-devel, David Ahern
From: David Ahern <dsahern@gmail.com>
Followup to a173f066c7cf ("netfilter: bridge: Don't sabotage nf_hook
calls from an l3mdev"). Some packets (e.g., ndisc) do not have the skb
device flipped to the l3mdev (e.g., VRF) device. Update ip_sabotage_in
to not drop packets for slave devices too. Currently, neighbor
solicitation packets for 'dev -> bridge (addr) -> vrf' setups are getting
dropped. This patch enables IPv6 communications for bridges with an
address that are enslaved to a VRF.
Fixes: 73e20b761acf ("net: vrf: Add support for PREROUTING rules on vrf device")
Signed-off-by: David Ahern <dsahern@gmail.com>
---
net/bridge/br_netfilter_hooks.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index c93c35bb73dd..8ab222babc98 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -831,7 +831,8 @@ static unsigned int ip_sabotage_in(void *priv,
struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
if (nf_bridge && !nf_bridge->in_prerouting &&
- !netif_is_l3_master(skb->dev)) {
+ !netif_is_l3_master(skb->dev) &&
+ !netif_is_l3_slave(skb->dev)) {
state->okfn(state->net, state->sk, skb);
return NF_STOLEN;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] netfilter: bridge: Don't sabotage nf_hook calls for an l3mdev slave
2019-02-26 0:21 [PATCH net] netfilter: bridge: Don't sabotage nf_hook calls for an l3mdev slave David Ahern
@ 2019-03-01 13:33 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2019-03-01 13:33 UTC (permalink / raw)
To: David Ahern; +Cc: netdev, netfilter-devel, David Ahern
On Mon, Feb 25, 2019 at 04:21:14PM -0800, David Ahern wrote:
> From: David Ahern <dsahern@gmail.com>
>
> Followup to a173f066c7cf ("netfilter: bridge: Don't sabotage nf_hook
> calls from an l3mdev"). Some packets (e.g., ndisc) do not have the skb
> device flipped to the l3mdev (e.g., VRF) device. Update ip_sabotage_in
> to not drop packets for slave devices too. Currently, neighbor
> solicitation packets for 'dev -> bridge (addr) -> vrf' setups are getting
> dropped. This patch enables IPv6 communications for bridges with an
> address that are enslaved to a VRF.
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-03-01 13:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-26 0:21 [PATCH net] netfilter: bridge: Don't sabotage nf_hook calls for an l3mdev slave David Ahern
2019-03-01 13:33 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.