[PATCH] netfilter: physdev: physdev-is-out should not work with OUTPUT chain

[PATCH] netfilter: physdev: physdev-is-out should not work with OUTPUT chain

[Hangbin Liu]

physdev_mt() will check skb->nf_bridge first, which was alloced in
br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out,
we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check()
only checked physdev-out and missed physdev-is-out. Fix it and update the
debug message to make it clearer.

Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
 net/netfilter/xt_physdev.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 1caaccb..e5f1898 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -102,14 +102,14 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
 	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
 	    info->bitmask & ~XT_PHYSDEV_OP_MASK)
 		return -EINVAL;
-	if (info->bitmask & XT_PHYSDEV_OP_OUT &&
+	if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
 	    (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
 	     info->invert & XT_PHYSDEV_OP_BRIDGED) &&
 	    par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
 	    (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
-		pr_info("using --physdev-out in the OUTPUT, FORWARD and "
-			"POSTROUTING chains for non-bridged traffic is not "
-			"supported anymore.\n");
+		pr_info("using --physdev-out and --physdev-is-out are only"
+			"supported in the FORWARD and POSTROUTING chains with"
+			"bridged traffic.\n");
 		if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
 			return -EINVAL;
 	}
-- 
2.5.5

Re: [PATCH] netfilter: physdev: physdev-is-out should not work with OUTPUT chain

[Marcelo Ricardo Leitner]

On Tue, Jul 05, 2016 at 08:55:36PM +0800, Hangbin Liu wrote:
> physdev_mt() will check skb->nf_bridge first, which was alloced in
> br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out,
> we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check()
> only checked physdev-out and missed physdev-is-out. Fix it and update the
> debug message to make it clearer.
> 
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>

Reviewed-by: Marcelo R Leitner <marcelo.leitner@gmail.com>

> ---
>  net/netfilter/xt_physdev.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
> index 1caaccb..e5f1898 100644
> --- a/net/netfilter/xt_physdev.c
> +++ b/net/netfilter/xt_physdev.c
> @@ -102,14 +102,14 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
>  	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
>  	    info->bitmask & ~XT_PHYSDEV_OP_MASK)
>  		return -EINVAL;
> -	if (info->bitmask & XT_PHYSDEV_OP_OUT &&
> +	if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
>  	    (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
>  	     info->invert & XT_PHYSDEV_OP_BRIDGED) &&
>  	    par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
>  	    (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
> -		pr_info("using --physdev-out in the OUTPUT, FORWARD and "
> -			"POSTROUTING chains for non-bridged traffic is not "
> -			"supported anymore.\n");
> +		pr_info("using --physdev-out and --physdev-is-out are only"
> +			"supported in the FORWARD and POSTROUTING chains with"
> +			"bridged traffic.\n");
>  		if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
>  			return -EINVAL;
>  	}
> -- 
> 2.5.5
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: [PATCH] netfilter: physdev: physdev-is-out should not work with OUTPUT chain

[Pablo Neira Ayuso]

On Tue, Jul 05, 2016 at 06:00:12PM -0300, Marcelo Ricardo Leitner wrote:
> On Tue, Jul 05, 2016 at 08:55:36PM +0800, Hangbin Liu wrote:
> > physdev_mt() will check skb->nf_bridge first, which was alloced in
> > br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out,
> > we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check()
> > only checked physdev-out and missed physdev-is-out. Fix it and update the
> > debug message to make it clearer.
> > 
> > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> 
> Reviewed-by: Marcelo R Leitner <marcelo.leitner@gmail.com>

Applied, thanks.

Re: [PATCH] netfilter: physdev: physdev-is-out should not work with OUTPUT chain

[Pablo Neira Ayuso]

On Wed, Jul 06, 2016 at 11:22:32AM +0200, Pablo Neira Ayuso wrote:
> On Tue, Jul 05, 2016 at 06:00:12PM -0300, Marcelo Ricardo Leitner wrote:
> > On Tue, Jul 05, 2016 at 08:55:36PM +0800, Hangbin Liu wrote:
> > > physdev_mt() will check skb->nf_bridge first, which was alloced in
> > > br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out,
> > > we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check()
> > > only checked physdev-out and missed physdev-is-out. Fix it and update the
> > > debug message to make it clearer.
> > > 
> > > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> > 
> > Reviewed-by: Marcelo R Leitner <marcelo.leitner@gmail.com>
> 
> Applied, thanks.

I have a batch ready for David now, so will be placing this in the
next batch actually.

Don't worry if you don't see this in the next pull request I'm going
to send.