netfilter: bridge: Don't sabotage nf_hook calls for an l3mdev slave
Followup to a173f066 ("netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev"). Some packets (e.g., ndisc) do not have the skb device flipped to the l3mdev (e.g., VRF) device. Update ip_sabotage_in to not drop packets for slave devices too. Currently, neighbor solicitation packets for 'dev -> bridge (addr) -> vrf' setups are getting dropped. This patch enables IPv6 communications for bridges with an address that are enslaved to a VRF. Fixes: 73e20b76 ("net: vrf: Add support for PREROUTING rules on vrf device") Signed-off-by:David Ahern <dsahern@gmail.com> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org>
Showing
Please register or sign in to comment