diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2009-01-12 03:06:02 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-01-13 08:18:33 +0300 |
| commit | a2bd40ad3151d4d346fd167e01fb84b06f7247fc (patch) | |
| tree | f5d703c8bcc2b91f23bc2e2310a2ef1f77d74f19 /net | |
| parent | 88843104a19d5896bf67ab6bd685e976240dd04a (diff) | |
| download | linux-a2bd40ad3151d4d346fd167e01fb84b06f7247fc.tar.xz | |
netfilter 02/09: bridge: Fix handling of non-IP packets in FORWARD/POST_ROUTING
Currently the bridge FORWARD/POST_ROUTING chains treats all
non-IPv4 packets as IPv6. This packet fixes that by returning
NF_ACCEPT on non-IP packets instead, just as is done in PRE_ROUTING.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bridge/br_netfilter.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index a65e43a17fbb..9a1cd757ec4e 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -686,8 +686,11 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb, if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb)) pf = PF_INET; - else + else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) || + IS_PPPOE_IPV6(skb)) pf = PF_INET6; + else + return NF_ACCEPT; nf_bridge_pull_encap_header(skb); @@ -828,8 +831,11 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb, if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb)) pf = PF_INET; - else + else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) || + IS_PPPOE_IPV6(skb)) pf = PF_INET6; + else + return NF_ACCEPT; #ifdef CONFIG_NETFILTER_DEBUG if (skb->dst == NULL) { |