| Message ID | 1467723336-27953-1-git-send-email-liuhangbin@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Tue, Jul 05, 2016 at 08:55:36PM +0800, Hangbin Liu wrote: > physdev_mt() will check skb->nf_bridge first, which was alloced in > br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out, > we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check() > only checked physdev-out and missed physdev-is-out. Fix it and update the > debug message to make it clearer. > > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Reviewed-by: Marcelo R Leitner <marcelo.leitner@gmail.com> > --- > net/netfilter/xt_physdev.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c > index 1caaccb..e5f1898 100644 > --- a/net/netfilter/xt_physdev.c > +++ b/net/netfilter/xt_physdev.c > @@ -102,14 +102,14 @@ static int physdev_mt_check(const struct xt_mtchk_param *par) > if (!(info->bitmask & XT_PHYSDEV_OP_MASK) || > info->bitmask & ~XT_PHYSDEV_OP_MASK) > return -EINVAL; > - if (info->bitmask & XT_PHYSDEV_OP_OUT && > + if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) && > (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) || > info->invert & XT_PHYSDEV_OP_BRIDGED) && > par->hook_mask & ((1 << NF_INET_LOCAL_OUT) | > (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) { > - pr_info("using --physdev-out in the OUTPUT, FORWARD and " > - "POSTROUTING chains for non-bridged traffic is not " > - "supported anymore.\n"); > + pr_info("using --physdev-out and --physdev-is-out are only" > + "supported in the FORWARD and POSTROUTING chains with" > + "bridged traffic.\n"); > if (par->hook_mask & (1 << NF_INET_LOCAL_OUT)) > return -EINVAL; > } > -- > 2.5.5 > > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Tue, Jul 05, 2016 at 06:00:12PM -0300, Marcelo Ricardo Leitner wrote: > On Tue, Jul 05, 2016 at 08:55:36PM +0800, Hangbin Liu wrote: > > physdev_mt() will check skb->nf_bridge first, which was alloced in > > br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out, > > we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check() > > only checked physdev-out and missed physdev-is-out. Fix it and update the > > debug message to make it clearer. > > > > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> > > Reviewed-by: Marcelo R Leitner <marcelo.leitner@gmail.com> Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Jul 06, 2016 at 11:22:32AM +0200, Pablo Neira Ayuso wrote: > On Tue, Jul 05, 2016 at 06:00:12PM -0300, Marcelo Ricardo Leitner wrote: > > On Tue, Jul 05, 2016 at 08:55:36PM +0800, Hangbin Liu wrote: > > > physdev_mt() will check skb->nf_bridge first, which was alloced in > > > br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out, > > > we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check() > > > only checked physdev-out and missed physdev-is-out. Fix it and update the > > > debug message to make it clearer. > > > > > > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> > > > > Reviewed-by: Marcelo R Leitner <marcelo.leitner@gmail.com> > > Applied, thanks. I have a batch ready for David now, so will be placing this in the next batch actually. Don't worry if you don't see this in the next pull request I'm going to send. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c index 1caaccb..e5f1898 100644 --- a/net/netfilter/xt_physdev.c +++ b/net/netfilter/xt_physdev.c @@ -102,14 +102,14 @@ static int physdev_mt_check(const struct xt_mtchk_param *par) if (!(info->bitmask & XT_PHYSDEV_OP_MASK) || info->bitmask & ~XT_PHYSDEV_OP_MASK) return -EINVAL; - if (info->bitmask & XT_PHYSDEV_OP_OUT && + if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) && (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) || info->invert & XT_PHYSDEV_OP_BRIDGED) && par->hook_mask & ((1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) { - pr_info("using --physdev-out in the OUTPUT, FORWARD and " - "POSTROUTING chains for non-bridged traffic is not " - "supported anymore.\n"); + pr_info("using --physdev-out and --physdev-is-out are only" + "supported in the FORWARD and POSTROUTING chains with" + "bridged traffic.\n"); if (par->hook_mask & (1 << NF_INET_LOCAL_OUT)) return -EINVAL; }
physdev_mt() will check skb->nf_bridge first, which was alloced in br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out, we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check() only checked physdev-out and missed physdev-is-out. Fix it and update the debug message to make it clearer. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> --- net/netfilter/xt_physdev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)