Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1606028 > unrolled thread

[PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device

Back to article view | Back to linux.kernel

Contents

  [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device Linus Lüssing <linus.luessing@c0d3.blue> - 2017-03-21 23:30 +0100
    Re: [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Stephen Hemminger <stephen@networkplumber.org> - 2017-03-22 00:40 +0100

#1606028 — [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device

When trying to redirect bridged frames to the bridge device itself
via the ebtables nat-prerouting chain and the dnat target then this
currently fails:

The ethernet destination of the frame is dnat'ed to the MAC address of
the bridge itself just fine and the correctly altered frame can even
be captured via a tcpdump on br0 (with or without promisc mode).

However, the IP code drops it in the beginning of ip_input.c/ip_rcv()
as the dnat target did not update the skb->pkt_type. If after
dnat'ing the packet is now destined to us then the skb->pkt_type
needs to be updated from PACKET_OTHERHOST to PACKET_HOST, too.

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

---
Changelog v2:
* refrain from altering pkt_type for multicast packets
  with a unicast destination MAC
---
 net/bridge/br_input.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 013f2290b..fd7bc4c 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -198,8 +198,13 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
 	if (dst) {
 		unsigned long now = jiffies;
 
-		if (dst->is_local)
+		if (dst->is_local) {
+			/* fix up potential DNAT inconsistencies */
+			if (skb->pkt_type == PACKET_OTHERHOST)
+				skb->pkt_type = PACKET_HOST;
+
 			return br_pass_frame_up(skb);
+		}
 
 		if (now != dst->used)
 			dst->used = now;
-- 
2.1.4

[toc] | [next] | [standalone]

#1606075 — Re: [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device

On Tue, 21 Mar 2017 23:28:45 +0100
Linus Lüssing <linus.luessing@c0d3.blue> wrote:

> However, the IP code drops it in the beginning of ip_input.c/ip_rcv()
> as the dnat target did not update the skb->pkt_type. If after
> dnat'ing the packet is now destined to us then the skb->pkt_type
> needs to be updated from PACKET_OTHERHOST to PACKET_HOST, too.

Why not fix DNAT netfilter module rather than hacking bridge code here.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web