Commit dbf3813c authored by Bart De Schuymer's avatar Bart De Schuymer Committed by Hideaki Yoshifuji

[NETFILTER]: Do not require ip_forwarding for reset on a bridge.

Currently, to be able to send a reset in the FORWARD chain of iptables
for bridged traffic, ip forwarding must be enabled. This causes confusion
and in some situations people really don't want to enable ip forwarding.
The patch below lets the user send reset packets for bridged frames in
the FORWARD chain, with ip forwarding disabled (as long as there is a
route).
parent e507c6fc
No related merge requests found
...@@ -24,6 +24,9 @@ ...@@ -24,6 +24,9 @@
#include <net/route.h> #include <net/route.h>
#include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_REJECT.h> #include <linux/netfilter_ipv4/ipt_REJECT.h>
#ifdef CONFIG_BRIDGE_NETFILTER
#include <linux/netfilter_bridge.h>
#endif
MODULE_LICENSE("GPL"); MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
...@@ -56,7 +59,13 @@ static inline struct rtable *route_reverse(struct sk_buff *skb, int hook) ...@@ -56,7 +59,13 @@ static inline struct rtable *route_reverse(struct sk_buff *skb, int hook)
struct flowi fl = {}; struct flowi fl = {};
struct rtable *rt; struct rtable *rt;
if (hook != NF_IP_FORWARD) { /* We don't require ip forwarding to be enabled to be able to
* send a RST reply for bridged traffic. */
if (hook != NF_IP_FORWARD
#ifdef CONFIG_BRIDGE_NETFILTER
|| (skb->nf_bridge && skb->nf_bridge->mask & BRNF_BRIDGED)
#endif
) {
fl.nl_u.ip4_u.daddr = iph->saddr; fl.nl_u.ip4_u.daddr = iph->saddr;
if (hook == NF_IP_LOCAL_IN) if (hook == NF_IP_LOCAL_IN)
fl.nl_u.ip4_u.saddr = iph->daddr; fl.nl_u.ip4_u.saddr = iph->daddr;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment