diff mbox

[RFC] bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries

Message ID 1416223228-8411-2-git-send-email-linus.luessing@c0d3.blue
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Linus Lüssing Nov. 17, 2014, 11:20 a.m. UTC 
From: Linus Lüssing <linus.luessing@web.de>

Ebtables on the OUTPUT chain (NF_BR_LOCAL_OUT) would not work as expected
for both locally generated IGMP and MLD queries. The IP header specific
filter options are off by 14 Bytes for netfilter (actual output on
interfaces is fine).

NF_HOOK() expects the skb->data to point to the IP header, not the
ethernet one (while dev_queue_xmit() does not). Luckily there is an
br_dev_queue_push_xmit() helper function already - let's just use that.

Introduced by eb1d16414339a6e113d89e2cca2556005d7ce919
("bridge: Add core IGMP snooping support")

Ebtables example:

$ ebtables -I OUTPUT -p IPv6 -o eth1 --logical-out br0 \
	--log --log-level 6 --log-ip6 --log-prefix="~EBT: " -j DROP

before (broken):

~EBT:  IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
	MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
	SRC=64a4:39c2:86dd:6000:0000:0020:0001:fe80 IPv6 \
	DST=0000:0000:0000:0004:64ff:fea4:39c2:ff02, \
	IPv6 priority=0x3, Next Header=2

after (working):

~EBT:  IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
	MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
	SRC=fe80:0000:0000:0000:0004:64ff:fea4:39c2 IPv6 \
	DST=ff02:0000:0000:0000:0000:0000:0000:0001, \
	IPv6 priority=0x0, Next Header=0

Signed-off-by: Linus Lüssing <linus.luessing@web.de>
---
 net/bridge/br_multicast.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Pablo Neira Ayuso Nov. 17, 2014, 11:42 a.m. UTC | #1 
On Mon, Nov 17, 2014 at 12:20:28PM +0100, Linus Lüssing wrote:
> From: Linus Lüssing <linus.luessing@web.de>
> 
> Ebtables on the OUTPUT chain (NF_BR_LOCAL_OUT) would not work as expected
> for both locally generated IGMP and MLD queries. The IP header specific
> filter options are off by 14 Bytes for netfilter (actual output on
> interfaces is fine).
> 
> NF_HOOK() expects the skb->data to point to the IP header, not the
> ethernet one (while dev_queue_xmit() does not). Luckily there is an
> br_dev_queue_push_xmit() helper function already - let's just use that.
> 
> Introduced by eb1d16414339a6e113d89e2cca2556005d7ce919
> ("bridge: Add core IGMP snooping support")
> 
> Ebtables example:
> 
> $ ebtables -I OUTPUT -p IPv6 -o eth1 --logical-out br0 \
> 	--log --log-level 6 --log-ip6 --log-prefix="~EBT: " -j DROP
> 
> before (broken):
> 
> ~EBT:  IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
> 	MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
> 	SRC=64a4:39c2:86dd:6000:0000:0020:0001:fe80 IPv6 \
> 	DST=0000:0000:0000:0004:64ff:fea4:39c2:ff02, \
> 	IPv6 priority=0x3, Next Header=2
> 
> after (working):
> 
> ~EBT:  IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \
> 	MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \
> 	SRC=fe80:0000:0000:0000:0004:64ff:fea4:39c2 IPv6 \
> 	DST=ff02:0000:0000:0000:0000:0000:0000:0001, \
> 	IPv6 priority=0x0, Next Header=0

Applied, thanks Linus.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 7751c92..9d02e6c 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -813,10 +813,9 @@  static void __br_multicast_send_query(struct net_bridge *br,
 		return;
 
 	if (port) {
-		__skb_push(skb, sizeof(struct ethhdr));
 		skb->dev = port->dev;
 		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
-			dev_queue_xmit);
+			br_dev_queue_push_xmit);
 	} else {
 		br_multicast_select_own_querier(br, ip, skb);
 		netif_rx(skb);