linux-stable.git/include/linux/netfilter_bridge.h, branch v3.10.78

UAPI: (Scripted) Disintegrate include/linux

2012-10-13T09:46:48+00:00

Signed-off-by: David Howells 
Acked-by: Arnd Bergmann 
Acked-by: Thomas Gleixner 
Acked-by: Michael Kerrisk 
Acked-by: Paul E. McKenney 
Acked-by: Dave Jones

set fake_rtable's dst to NULL to avoid kernel Oops

2012-04-24T04:16:24+00:00

bridge: set fake_rtable's dst to NULL to avoid kernel Oops

when bridge is deleted before tap/vif device's delete, kernel may
encounter an oops because of NULL reference to fake_rtable's dst.
Set fake_rtable's dst to NULL before sending packets out can solve
this problem.

v4 reformat, change br_drop_fake_rtable(skb) to {}

v3 enrich commit header

v2 introducing new flag DST_FAKE_RTABLE to dst_entry struct.

[ Use "do { } while (0)" for nop br_drop_fake_rtable()
  implementation -DaveM ]

Acked-by: Eric Dumazet 
Signed-off-by: Peter Huang 
Signed-off-by: David S. Miller

netfilter: bridge-netfilter: fix refragmenting IP traffic encapsulated in PPPoE traffic

2010-04-20T14:22:01+00:00

The MTU for IP traffic encapsulated inside PPPoE traffic is smaller
than the MTU of the Ethernet device (1500). Connection tracking
gathers all IP packets and sometimes will refragment them in
ip_fragment(). We then need to subtract the length of the
encapsulating header from the mtu used in ip_fragment(). The check in
br_nf_dev_queue_xmit() which determines if ip_fragment() has to be
called is also updated for the PPPoE-encapsulated packets.
nf_bridge_copy_header() is also updated to make sure the PPPoE data
length field has the correct value.

Signed-off-by: Bart De Schuymer 
Signed-off-by: Patrick McHardy

netfilter: bridge-netfilter: Fix MAC header handling with IP DNAT

2010-04-15T10:26:39+00:00

- fix IP DNAT on vlan- or pppoe-encapsulated traffic: The functions
neigh_hh_output() or dst->neighbour->output() overwrite the complete
Ethernet header, although we only need the destination MAC address.
For encapsulated packets, they ended up overwriting the encapsulating
header. The new code copies the Ethernet source MAC address and
protocol number before calling dst->neighbour->output(). The Ethernet
source MAC and protocol number are copied back in place in
br_nf_pre_routing_finish_bridge_slow(). This also makes the IP DNAT
more transparent because in the old scheme the source MAC of the
bridge was copied into the source address in the Ethernet header. We
also let skb->protocol equal ETH_P_IP resp. ETH_P_IPV6 during the
execution of the PF_INET resp. PF_INET6 hooks.

- Speed up IP DNAT by calling neigh_hh_bridge() instead of
neigh_hh_output(): if dst->hh is available, we already know the MAC
address so we can just copy it.

Signed-off-by: Bart De Schuymer 
Signed-off-by: Patrick McHardy

netfilter: bridge-netfilter: simplify IP DNAT

2010-04-15T10:14:51+00:00

Remove br_netfilter.c::br_nf_local_out(). The function
br_nf_local_out() was needed because the PF_BRIDGE::LOCAL_OUT hook
could be called when IP DNAT happens on to-be-bridged traffic. The
new scheme eliminates this mess.

Signed-off-by: Bart De Schuymer 
Signed-off-by: Patrick McHardy

net: replace __constant_{endian} uses in net headers

2009-02-15T06:58:35+00:00

Base versions handle constant folding now.  For headers exposed to
userspace, we must only expose the __ prefixed versions.

Signed-off-by: Harvey Harrison 
Signed-off-by: David S. Miller

[NETFILTER]: bridge: fix missing link layer headers on outgoing routed packets

2007-12-14T21:54:39+00:00

As reported by Damien Thebault, the double POSTROUTING hook invocation
fix caused outgoing packets routed between two bridges to appear without
a link-layer header. The reason for this is that we're skipping the
br_nf_post_routing hook for routed packets now and don't save the
original link layer header, but nevertheless tries to restore it on
output, causing corruption.

The root cause for this is that skb->nf_bridge has no clearly defined
lifetime and is used to indicate all kind of things, but that is
quite complicated to fix. For now simply don't touch these packets
and handle them like packets from any other device.

Tested-by: Damien Thebault 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: bridge netfilter: consolidate header pushing/pulling code

2007-05-03T10:36:16+00:00

Consolidate the common push/pull sequences into a few helper functions.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 encapsulated in pppoe traffic

2007-04-26T05:28:57+00:00

The attached patch by Michael Milner adds support for using iptables and
ip6tables on bridged traffic encapsulated in ppoe frames, similar to
what's already supported for vlan.

Signed-off-by: Michael Milner 
Signed-off-by: Bart De Schuymer 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: bridge-netfilter: remove deferred hooks

2006-12-14T00:54:25+00:00

Remove the deferred hooks and all related code as scheduled in
feature-removal-schedule.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller