From 4a9ecd5960e6a7814f6e3405807d49010ffe3a88 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Thu, 13 Dec 2007 09:32:04 -0800 Subject: [PATCH] [NETFILTER]: bridge: fix missing link layer headers on outgoing routed packets As reported by Damien Thebault, the double POSTROUTING hook invocation fix caused outgoing packets routed between two bridges to appear without a link-layer header. The reason for this is that we're skipping the br_nf_post_routing hook for routed packets now and don't save the original link layer header, but nevertheless tries to restore it on output, causing corruption. The root cause for this is that skb->nf_bridge has no clearly defined lifetime and is used to indicate all kind of things, but that is quite complicated to fix. For now simply don't touch these packets and handle them like packets from any other device. Tested-by: Damien Thebault Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- include/linux/netfilter_bridge.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h index 533ee351a273..499aa9375901 100644 --- a/include/linux/netfilter_bridge.h +++ b/include/linux/netfilter_bridge.h @@ -50,7 +50,8 @@ enum nf_br_hook_priorities { extern int nf_bridge_copy_header(struct sk_buff *skb); static inline int nf_bridge_maybe_copy_header(struct sk_buff *skb) { - if (skb->nf_bridge) + if (skb->nf_bridge && + skb->nf_bridge->mask & (BRNF_BRIDGED | BRNF_BRIDGED_DNAT)) return nf_bridge_copy_header(skb); return 0; } -- GitLab