linux-stable.git/net/bridge, branch linux-2.6.24.y

NETFILTER: fix ebtable targets return

2008-03-24T18:47:23+00:00

Upstream commit 1b04ab459:

The function ebt_do_table doesn't take NF_DROP as a verdict from the targets.

Signed-off-by: Joonwoo Park 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

NETFILTER: Fix incorrect use of skb_make_writable

2008-03-24T18:47:23+00:00

Upstream commit eb1197bc0:

http://bugzilla.kernel.org/show_bug.cgi?id=9920
The function skb_make_writable returns true or false.

Signed-off-by: Joonwoo Park 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[NETFILTER]: bridge-netfilter: fix net_device refcnt leaks

2008-01-21T04:31:41+00:00

When packets are flood-forwarded to multiple output devices, the
bridge-netfilter code reuses skb->nf_bridge for each clone to store
the bridge port. When queueing packets using NFQUEUE netfilter takes
a reference to skb->nf_bridge->physoutdev, which is overwritten
when the packet is forwarded to the second port. This causes
refcount unterflows for the first device and refcount leaks for all
others. Additionally this provides incorrect data to the iptables
physdev match.

Unshare skb->nf_bridge by copying it if it is shared before assigning
the physoutdev device.

Reported, tested and based on initial patch by
Jan Christoph Nordholz .

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: bridge: fix double POST_ROUTING invocation

2008-01-12T02:02:18+00:00

The bridge code incorrectly causes two POST_ROUTING hook invocations
for DNATed packets that end up on the same bridge device. This
happens because packets with a changed destination address are passed
to dst_output() to make them go through the neighbour output function
again to build a new destination MAC address, before they will continue
through the IP hooks simulated by bridge netfilter.

The resulting hook order is:
 PREROUTING	(bridge netfilter)
 POSTROUTING	(dst_output -> ip_output)
 FORWARD	(bridge netfilter)
 POSTROUTING	(bridge netfilter)

The deferred hooks used to abort the first POST_ROUTING invocation,
but since the only thing bridge netfilter actually really wants is
a new MAC address, we can avoid going through the IP stack completely
by simply calling the neighbour output function directly.

Tested, reported and lots of data provided by: Damien Thebault 

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[BRIDGE]: Assign random address.

2007-12-16T21:35:51+00:00

Assigning a valid random address to bridge device solves problems
when bridge device is brought up before adding real device to bridge.
When the first real device is added to the bridge, it's address
will overide the bridges random address.

Note: any device added to a bridge must already have a valid
ethernet address.
 br_add_if -> br_fdb_insert -> fdb_insert -> is_valid_ether_addr

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[BRIDGE]: Section fix.

2007-12-07T09:05:53+00:00

WARNING: vmlinux.o(.init.text+0x204e2): Section mismatch: reference to .exit.text:br_fdb_fini (between 'br_init' and 'br_fdb_init')

Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

[BRIDGE]: Properly dereference the br_should_route_hook

2007-11-29T12:58:58+00:00

This hook is protected with the RCU, so simple

	if (br_should_route_hook)
		br_should_route_hook(...)

is not enough on some architectures.

Use the rcu_dereference/rcu_assign_pointer in this case.

Fixed Stephen's comment concerning using the typeof().

Signed-off-by: Pavel Emelyanov 
Signed-off-by: Herbert Xu

[BRIDGE]: Lost call to br_fdb_fini() in br_init() error path

2007-11-29T12:41:43+00:00

In case the br_netfilter_init() (or any subsequent call) 
fails, the br_fdb_fini() must be called to free the allocated
in br_fdb_init() br_fdb_cache kmem cache.

Signed-off-by: Pavel Emelyanov 
Signed-off-by: Herbert Xu

[BRIDGE]: Add missing "space"

2007-11-20T07:46:55+00:00

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

[NETFILTER]: bridge: fix double POSTROUTING hook invocation

2007-11-13T10:58:44+00:00

Packets routed between bridges have the POST_ROUTING hook invoked
twice since bridging mistakes them for bridged packets because
they have skb->nf_bridge set.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller