openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity
linux/net/ipv4/netfilter
History
Patrick McHardy a193a4abdd [NETFILTER]: Fix skb->nf_bridge lifetime issues 
The bridge netfilter code simulates the NF_IP_PRE_ROUTING hook and skips
the real hook by registering with high priority and returning NF_STOP if
skb->nf_bridge is present and the BRNF_NF_BRIDGE_PREROUTING flag is not
set. The flag is only set during the simulated hook.

Because skb->nf_bridge is only freed when the packet is destroyed, the
packet will not only skip the first invocation of NF_IP_PRE_ROUTING, but
in the case of tunnel devices on top of the bridge also all further ones.
Forwarded packets from a bridge encapsulated by a tunnel device and sent
as locally outgoing packet will also still have the incorrect bridge
information from the input path attached.

We already have nf_reset calls on all RX/TX paths of tunnel devices,
so simply reset the nf_bridge field there too. As an added bonus,
the bridge information for locally delivered packets is now also freed
when the packet is queued to a socket.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2006-03-20 19:23:05 -08:00
..
Kconfig [NETFILTER]: x_tables: replace IPv4/IPv6 policy match by address family independant version 2006-03-20 18:03:40 -08:00
Makefile [NETFILTER]: x_tables: replace IPv4/IPv6 policy match by address family independant version 2006-03-20 18:03:40 -08:00
arp_tables.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
arpt_mangle.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
arptable_filter.c [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables 2006-01-12 14:06:43 -08:00
ip_conntrack_amanda.c [NETFILTER]: Fix module_param types and permissions 2006-01-05 12:19:46 -08:00
ip_conntrack_core.c [NETFILTER]: Fix ip_conntrack_flush abuse in ctnetlink 2005-12-05 13:33:50 -08:00
ip_conntrack_ftp.c [NETFILTER]: Fix module_param types and permissions 2006-01-05 12:19:46 -08:00
ip_conntrack_helper_pptp.c [NETFILTER]: ip_ct_proto_gre_fini() cannot be __exit 2006-01-11 16:32:12 -08:00
ip_conntrack_irc.c [NETFILTER]: Fix module_param types and permissions 2006-01-05 12:19:46 -08:00
ip_conntrack_netbios_ns.c [NETFILTER]: Fix module_param types and permissions 2006-01-05 12:19:46 -08:00
ip_conntrack_netlink.c [NETFILTER]: ctnetlink: avoid unneccessary event message generation 2006-03-20 18:03:59 -08:00
ip_conntrack_proto_generic.c [NETFILTER]: Fix timeout sysctls on big-endian 64bit architectures 2006-01-10 12:54:35 -08:00
ip_conntrack_proto_gre.c [NETFILTER]: ip_conntrack_proto_gre.c needs linux/interrupt.h 2006-01-17 02:42:02 -08:00
ip_conntrack_proto_icmp.c netfilter: headers included twice 2006-01-11 02:04:35 +01:00
ip_conntrack_proto_sctp.c [NETFILTER]: Fix timeout sysctls on big-endian 64bit architectures 2006-01-10 12:54:35 -08:00
ip_conntrack_proto_tcp.c netfilter: headers included twice 2006-01-11 02:04:35 +01:00
ip_conntrack_proto_udp.c netfilter: headers included twice 2006-01-11 02:04:35 +01:00
ip_conntrack_standalone.c [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables 2006-01-12 14:06:43 -08:00
ip_conntrack_tftp.c [NETFILTER]: Fix missing src port initialization in tftp expectation mask 2006-02-04 23:51:21 -08:00
ip_nat_amanda.c [NETFILTER]: ip_conntrack_expect_related must not free expectation 2005-07-21 13:14:46 -07:00
ip_nat_core.c [NETFILTER]: Fix NAT PMTUD problems 2006-02-19 22:26:40 -08:00
ip_nat_ftp.c kbuild: un-stringnify KBUILD_MODNAME 2006-01-06 21:17:50 +01:00
ip_nat_helper.c [NETFILTER]: Fix invalid module autoloading by splitting iptable_nat 2005-09-26 15:25:11 -07:00
ip_nat_helper_pptp.c [NETFILTER]: Fix CID offset bug in PPTP NAT helper debug message 2006-03-20 17:58:21 -08:00
ip_nat_irc.c kbuild: un-stringnify KBUILD_MODNAME 2006-01-06 21:17:50 +01:00
ip_nat_proto_gre.c [NETFILTER]: Remove unused function from NAT protocol helpers 2006-01-10 12:54:34 -08:00
ip_nat_proto_icmp.c [NETFILTER]: Remove unused function from NAT protocol helpers 2006-01-10 12:54:34 -08:00
ip_nat_proto_tcp.c [NETFILTER]: Remove unused function from NAT protocol helpers 2006-01-10 12:54:34 -08:00
ip_nat_proto_udp.c [NETFILTER]: Remove unused function from NAT protocol helpers 2006-01-10 12:54:34 -08:00
ip_nat_proto_unknown.c [NETFILTER]: Remove unused function from NAT protocol helpers 2006-01-10 12:54:34 -08:00
ip_nat_rule.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ip_nat_snmp_basic.c [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
ip_nat_standalone.c [NETFILTER]: Fix outgoing redirects to loopback 2006-02-19 22:29:47 -08:00
ip_nat_tftp.c [NETFILTER]: ip_nat_tftp: Fix expectation NAT 2005-12-12 15:02:48 -08:00
ip_queue.c [NETFILTER] ip_queue: Fix wrong skb->len == nlmsg_len assumption 2006-03-07 14:56:12 -08:00
ip_tables.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_CLUSTERIP.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_DSCP.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_ECN.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_LOG.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_MASQUERADE.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_NETMAP.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_REDIRECT.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_REJECT.c [NETFILTER]: Fix skb->nf_bridge lifetime issues 2006-03-20 19:23:05 -08:00
ipt_SAME.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_TCPMSS.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_TOS.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_TTL.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_ULOG.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_addrtype.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_ah.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_dscp.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_ecn.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_esp.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_hashlimit.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_iprange.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_multiport.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_owner.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_recent.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_tos.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ipt_ttl.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
iptable_filter.c [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables 2006-01-12 14:06:43 -08:00
iptable_mangle.c [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables 2006-01-12 14:06:43 -08:00
iptable_raw.c [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables 2006-01-12 14:06:43 -08:00
nf_conntrack_l3proto_ipv4.c [NETFILTER] nf_conntrack: clean up to reduce size of 'struct nf_conn' 2006-03-20 17:56:32 -08:00
nf_conntrack_proto_icmp.c [NETFILTER]: Add ctnetlink port for nf_conntrack 2006-01-05 12:19:05 -08:00