path: root/net/bridge/br_netfilter.c
diff options
authorPablo Neira Ayuso <pablo@netfilter.org>2014-10-02 11:13:21 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2014-10-02 18:30:57 +0200
commit4b7fd5d97ee6e599247b4a55122ca6ba80c8148d (patch)
treef79ecdd32fb619bcf982dcb493997f2285311a92 /net/bridge/br_netfilter.c
parentnetfilter: nf_tables: allow to filter from prerouting and postrouting (diff)
netfilter: explicit module dependency between br_netfilter and physdev
You can use physdev to match the physical interface enslaved to the bridge device. This information is stored in skb->nf_bridge and it is set up by br_netfilter. So, this is only available when iptables is used from the bridge netfilter path. Since 34666d4 ("netfilter: bridge: move br_netfilter out of the core"), the br_netfilter code is modular. To reduce the impact of this change, we can autoload the br_netfilter if the physdev match is used since we assume that the users need br_netfilter in place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/bridge/br_netfilter.c')
1 files changed, 5 insertions, 0 deletions
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 97e43937aaca..fa1270cc5086 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -856,6 +856,11 @@ static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops,
return NF_ACCEPT;
+void br_netfilter_enable(void)
/* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
* br_dev_queue_push_xmit is called afterwards */
static struct nf_hook_ops br_nf_ops[] __read_mostly = {