From mboxrd@z Thu Jan 1 00:00:00 1970 From: Hangbin Liu Subject: [PATCH] netfilter: physdev: physdev-is-out should not work with OUTPUT chain Date: Tue, 5 Jul 2016 20:55:36 +0800 Message-ID: <1467723336-27953-1-git-send-email-liuhangbin@gmail.com> Cc: Pablo Neira Ayuso , Hangbin Liu To: netfilter-devel@vger.kernel.org Return-path: Received: from mail-pf0-f194.google.com ([209.85.192.194]:36450 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754401AbcGEMzz (ORCPT ); Tue, 5 Jul 2016 08:55:55 -0400 Received: by mail-pf0-f194.google.com with SMTP id i123so19032828pfg.3 for ; Tue, 05 Jul 2016 05:55:55 -0700 (PDT) Sender: netfilter-devel-owner@vger.kernel.org List-ID: physdev_mt() will check skb->nf_bridge first, which was alloced in br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out, we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check() only checked physdev-out and missed physdev-is-out. Fix it and update the debug message to make it clearer. Signed-off-by: Hangbin Liu --- net/netfilter/xt_physdev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c index 1caaccb..e5f1898 100644 --- a/net/netfilter/xt_physdev.c +++ b/net/netfilter/xt_physdev.c @@ -102,14 +102,14 @@ static int physdev_mt_check(const struct xt_mtchk_param *par) if (!(info->bitmask & XT_PHYSDEV_OP_MASK) || info->bitmask & ~XT_PHYSDEV_OP_MASK) return -EINVAL; - if (info->bitmask & XT_PHYSDEV_OP_OUT && + if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) && (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) || info->invert & XT_PHYSDEV_OP_BRIDGED) && par->hook_mask & ((1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) { - pr_info("using --physdev-out in the OUTPUT, FORWARD and " - "POSTROUTING chains for non-bridged traffic is not " - "supported anymore.\n"); + pr_info("using --physdev-out and --physdev-is-out are only" + "supported in the FORWARD and POSTROUTING chains with" + "bridged traffic.\n"); if (par->hook_mask & (1 << NF_INET_LOCAL_OUT)) return -EINVAL; } -- 2.5.5