| Message ID | 1483796035-54792-2-git-send-email-zlpnobody@163.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Sat, Jan 07, 2017 at 09:33:55PM +0800, Liping Zhang wrote: > From: Liping Zhang <zlpnobody@gmail.com> > > After adding the following nft rule, then ping 224.0.0.1: > # nft add rule netdev t c pkttype host counter > > The warning complain message will be printed out again and again: > WARNING: CPU: 0 PID: 10182 at net/netfilter/nft_meta.c:163 \ > nft_meta_get_eval+0x3fe/0x460 [nft_meta] > [...] > Call Trace: > <IRQ> > dump_stack+0x85/0xc2 > __warn+0xcb/0xf0 > warn_slowpath_null+0x1d/0x20 > nft_meta_get_eval+0x3fe/0x460 [nft_meta] > nft_do_chain+0xff/0x5e0 [nf_tables] > > So we should deal with PACKET_LOOPBACK in netdev family too. For ipv4, > convert it to PACKET_BROADCAST/MULTICAST according to the destination > address's type; For ipv6, convert it to PACKET_MULTICAST directly. Also applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 9a22b24..e1f5ca9 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -156,8 +156,34 @@ void nft_meta_get_eval(const struct nft_expr *expr, case NFPROTO_IPV6: *dest = PACKET_MULTICAST; break; + case NFPROTO_NETDEV: + switch (skb->protocol) { + case htons(ETH_P_IP): { + int noff = skb_network_offset(skb); + struct iphdr *iph, _iph; + + iph = skb_header_pointer(skb, noff, + sizeof(_iph), &_iph); + if (!iph) + goto err; + + if (ipv4_is_multicast(iph->daddr)) + *dest = PACKET_MULTICAST; + else + *dest = PACKET_BROADCAST; + + break; + } + case htons(ETH_P_IPV6): + *dest = PACKET_MULTICAST; + break; + default: + WARN_ON_ONCE(1); + goto err; + } + break; default: - WARN_ON(1); + WARN_ON_ONCE(1); goto err; } break;