diff options
| author |   David Ahern <dsahern@gmail.com> | 2019-02-25 16:21:14 -0800 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2019-03-01 14:28:45 +0100 |
| commit | cd6428988bf4fcc41d1deb7dae0e92e62c075c57 (patch) | |
| tree | 4b51e3075257103df91a2fa59a217bfcd77336f2 /net/netfilter/nf_tables_core.c | |
| parent | ipvs: get sctphdr by sctphoff in sctp_csum_check (diff) | |
| download | linux-dev-cd6428988bf4fcc41d1deb7dae0e92e62c075c57.tar.xz linux-dev-cd6428988bf4fcc41d1deb7dae0e92e62c075c57.zip | |
netfilter: bridge: Don't sabotage nf_hook calls for an l3mdev slave
Followup to a173f066c7cf ("netfilter: bridge: Don't sabotage nf_hook
calls from an l3mdev"). Some packets (e.g., ndisc) do not have the skb
device flipped to the l3mdev (e.g., VRF) device. Update ip_sabotage_in
to not drop packets for slave devices too. Currently, neighbor
solicitation packets for 'dev -> bridge (addr) -> vrf' setups are getting
dropped. This patch enables IPv6 communications for bridges with an
address that are enslaved to a VRF.
Fixes: 73e20b761acf ("net: vrf: Add support for PREROUTING rules on vrf device")
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_tables_core.c')
0 files changed, 0 insertions, 0 deletions