* [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries
@ 2014-09-21 23:32 Linus Lüssing
2014-11-02 15:37 ` Linus Lüssing
2014-11-02 22:01 ` Herbert Xu
0 siblings, 2 replies; 6+ messages in thread
From: Linus Lüssing @ 2014-09-21 23:32 UTC (permalink / raw)
To: netdev
Cc: Herbert Xu, bridge, linux-kernel, Stephen Hemminger,
Linus Lüssing, David S. Miller
Ebtables on the OUTPUT chain (NF_BR_LOCAL_OUT) would not work as expected
for both locally generated IGMP and MLD queries. The IP header specific
filter options are off by 14 Bytes for netfilter (actual output on
interfaces is fine).
NF_HOOK() expects the skb->data to point to the IP header, not the
ethernet one (while dev_queue_xmit() does not). Luckily there is an
br_dev_queue_push_xmit() helper function already - let's just use that.
Introduced by eb1d16414339a6e113d89e2cca2556005d7ce919
("bridge: Add core IGMP snooping support")
Ebtables example:
$ ebtables -I OUTPUT -p IPv6 -o eth1 --logical-out br0 \
--log --log-level 6 --log-ip6 --log-prefix="~EBT: " -j DROP
before (broken):
~EBT: IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
SRC=64a4:39c2:86dd:6000:0000:0020:0001:fe80 IPv6 \
DST=0000:0000:0000:0004:64ff:fea4:39c2:ff02, \
IPv6 priority=0x3, Next Header=2
after (working):
~EBT: IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
SRC=fe80:0000:0000:0000:0004:64ff:fea4:39c2 IPv6 \
DST=ff02:0000:0000:0000:0000:0000:0000:0001, \
IPv6 priority=0x0, Next Header=0
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
---
net/bridge/br_multicast.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 7751c92..9d02e6c 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -813,10 +813,9 @@ static void __br_multicast_send_query(struct net_bridge *br,
return;
if (port) {
- __skb_push(skb, sizeof(struct ethhdr));
skb->dev = port->dev;
NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
- dev_queue_xmit);
+ br_dev_queue_push_xmit);
} else {
br_multicast_select_own_querier(br, ip, skb);
netif_rx(skb);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries
2014-09-21 23:32 [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries Linus Lüssing
@ 2014-11-02 15:37 ` Linus Lüssing
2014-11-02 22:01 ` Herbert Xu
1 sibling, 0 replies; 6+ messages in thread
From: Linus Lüssing @ 2014-11-02 15:37 UTC (permalink / raw)
To: netdev; +Cc: bridge, Stephen Hemminger, David S. Miller, Herbert Xu,
linux-kernel
On Mon, Sep 22, 2014 at 01:32:44AM +0200, Linus Lüssing wrote:
> Ebtables on the OUTPUT chain (NF_BR_LOCAL_OUT) would not work as expected
> for both locally generated IGMP and MLD queries. The IP header specific
> filter options are off by 14 Bytes for netfilter (actual output on
> interfaces is fine).
>
> NF_HOOK() expects the skb->data to point to the IP header, not the
> ethernet one (while dev_queue_xmit() does not). Luckily there is an
> br_dev_queue_push_xmit() helper function already - let's just use that.
bump
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries
2014-09-21 23:32 [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries Linus Lüssing
2014-11-02 15:37 ` Linus Lüssing
@ 2014-11-02 22:01 ` Herbert Xu
2014-11-17 2:08 ` Linus Lüssing
1 sibling, 1 reply; 6+ messages in thread
From: Herbert Xu @ 2014-11-02 22:01 UTC (permalink / raw)
To: Linus Lüssing
Cc: Stephen Hemminger, netdev, bridge, David S. Miller, linux-kernel
On Mon, Sep 22, 2014 at 01:32:44AM +0200, Linus Lüssing wrote:
> Ebtables on the OUTPUT chain (NF_BR_LOCAL_OUT) would not work as expected
> for both locally generated IGMP and MLD queries. The IP header specific
> filter options are off by 14 Bytes for netfilter (actual output on
> interfaces is fine).
>
> NF_HOOK() expects the skb->data to point to the IP header, not the
> ethernet one (while dev_queue_xmit() does not). Luckily there is an
> br_dev_queue_push_xmit() helper function already - let's just use that.
>
> Introduced by eb1d16414339a6e113d89e2cca2556005d7ce919
> ("bridge: Add core IGMP snooping support")
>
> Ebtables example:
>
> $ ebtables -I OUTPUT -p IPv6 -o eth1 --logical-out br0 \
> --log --log-level 6 --log-ip6 --log-prefix="~EBT: " -j DROP
>
> before (broken):
>
> ~EBT: IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
> MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
> SRC=64a4:39c2:86dd:6000:0000:0020:0001:fe80 IPv6 \
> DST=0000:0000:0000:0004:64ff:fea4:39c2:ff02, \
> IPv6 priority=0x3, Next Header=2
>
> after (working):
>
> ~EBT: IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
> MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
> SRC=fe80:0000:0000:0000:0004:64ff:fea4:39c2 IPv6 \
> DST=ff02:0000:0000:0000:0000:0000:0000:0001, \
> IPv6 priority=0x0, Next Header=0
>
> Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries
2014-11-02 22:01 ` Herbert Xu
@ 2014-11-17 2:08 ` Linus Lüssing
2014-11-17 2:33 ` Herbert Xu
2014-11-17 6:12 ` David Miller
0 siblings, 2 replies; 6+ messages in thread
From: Linus Lüssing @ 2014-11-17 2:08 UTC (permalink / raw)
To: David S. Miller
Cc: Linus Lüssing, netdev, bridge, Stephen Hemminger, Herbert Xu,
linux-kernel
On Mon, Nov 03, 2014 at 06:01:46AM +0800, Herbert Xu wrote:
> On Mon, Sep 22, 2014 at 01:32:44AM +0200, Linus Lüssing wrote:
> > Signed-off-by: Linus Lüssing <linus.luessing@web.de>
>
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Hi David,
are there any unanswered questions left?
Cheers, Linus
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries
2014-11-17 2:08 ` Linus Lüssing
@ 2014-11-17 2:33 ` Herbert Xu
2014-11-17 6:12 ` David Miller
1 sibling, 0 replies; 6+ messages in thread
From: Herbert Xu @ 2014-11-17 2:33 UTC (permalink / raw)
To: Linus Lüssing
Cc: Stephen Hemminger, netdev, bridge, David S. Miller, linux-kernel
On Mon, Nov 17, 2014 at 03:08:16AM +0100, Linus Lüssing wrote:
> On Mon, Nov 03, 2014 at 06:01:46AM +0800, Herbert Xu wrote:
> > On Mon, Sep 22, 2014 at 01:32:44AM +0200, Linus Lüssing wrote:
> > > Signed-off-by: Linus Lüssing <linus.luessing@web.de>
> >
> > Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
>
> Hi David,
>
> are there any unanswered questions left?
Please resubmit your patch as it's no longer in David's queue.
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries
2014-11-17 2:08 ` Linus Lüssing
2014-11-17 2:33 ` Herbert Xu
@ 2014-11-17 6:12 ` David Miller
1 sibling, 0 replies; 6+ messages in thread
From: David Miller @ 2014-11-17 6:12 UTC (permalink / raw)
To: linus.luessing; +Cc: stephen, netdev, bridge, herbert, linux-kernel
From: Linus Lüssing <linus.luessing@c0d3.blue>
Date: Mon, 17 Nov 2014 03:08:16 +0100
> On Mon, Nov 03, 2014 at 06:01:46AM +0800, Herbert Xu wrote:
>> On Mon, Sep 22, 2014 at 01:32:44AM +0200, Linus Lüssing wrote:
>> > Signed-off-by: Linus Lüssing <linus.luessing@web.de>
>>
>> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
>
> Hi David,
>
> are there any unanswered questions left?
I expect to get this from the netfilter folks, since it is a
netfilter change. So you should submit it to the netfilter
maintainers.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-11-17 6:12 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-09-21 23:32 [PATCH] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries Linus Lüssing
2014-11-02 15:37 ` Linus Lüssing
2014-11-02 22:01 ` Herbert Xu
2014-11-17 2:08 ` Linus Lüssing
2014-11-17 2:33 ` Herbert Xu
2014-11-17 6:12 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).