[NETFILTER]: bridge: fix missing link layer headers on outgoing routed packets

[NETFILTER]: bridge: fix missing link layer headers on outgoing routed packets

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 0 bytes --]



[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1538 bytes --]

commit 8579176d1476637ed7e87c770e2c64da4453a6e6
Author: Patrick McHardy <kaber@trash.net>
Date:   Thu Dec 13 17:54:52 2007 +0100

    [NETFILTER]: bridge: fix missing link layer headers on outgoing routed packets
    
    As reported by Damien Thebault, the double POSTROUTING hook invocation
    fix caused outgoing packets routed between two bridges to appear without
    a link-layer header. The reason for this is that we're skipping the
    br_nf_post_routing hook for routed packets now and don't save the
    original link layer header, but nevertheless tries to restore it on
    output, causing corruption.
    
    The root cause for this is that skb->nf_bridge has no clearly defined
    lifetime and is used to indicate all kind of things, but that is
    quite complicated to fix. For now simply don't touch these packets
    and handle them like packets from any other device.
    
    Tested-by: Damien Thebault <damien.thebault@gmail.com>
    Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 533ee35..499aa93 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -50,7 +50,8 @@ enum nf_br_hook_priorities {
 extern int nf_bridge_copy_header(struct sk_buff *skb);
 static inline int nf_bridge_maybe_copy_header(struct sk_buff *skb)
 {
-	if (skb->nf_bridge)
+	if (skb->nf_bridge &&
+	    skb->nf_bridge->mask & (BRNF_BRIDGED | BRNF_BRIDGED_DNAT))
 		return nf_bridge_copy_header(skb);
   	return 0;
 }

Re: [NETFILTER]: bridge: fix missing link layer headers on outgoing routed packets

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Thu, 13 Dec 2007 18:28:38 +0100

> [NETFILTER]: bridge: fix missing link layer headers on outgoing routed packets
> 
> As reported by Damien Thebault, the double POSTROUTING hook invocation
> fix caused outgoing packets routed between two bridges to appear without
> a link-layer header. The reason for this is that we're skipping the
> br_nf_post_routing hook for routed packets now and don't save the
> original link layer header, but nevertheless tries to restore it on
> output, causing corruption.
> 
> The root cause for this is that skb->nf_bridge has no clearly defined
> lifetime and is used to indicate all kind of things, but that is
> quite complicated to fix. For now simply don't touch these packets
> and handle them like packets from any other device.
> 
> Tested-by: Damien Thebault <damien.thebault@gmail.com>
> Signed-off-by: Patrick McHardy <kaber@trash.net>

Applied to net-2.6, thanks Patrick.