netfilter: physdev: physdev-is-out should not work with OUTPUT chain (47c74456) · Commits · 戴 / test

physdev_mt() will check skb->nf_bridge first, which was alloced in br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out, we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check() only checked physdev-out and missed physdev-is-out. Fix it and update the debug message to make it clearer. Signed-off-by:

Hangbin Liu <liuhangbin@gmail.com> Reviewed-by:

Marcelo R Leitner <marcelo.leitner@gmail.com> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/xt_physdev.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -102,14 +102,14 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
		if (!(info->bitmask & XT_PHYSDEV_OP_MASK) \|\|
		info->bitmask & ~XT_PHYSDEV_OP_MASK)
		return -EINVAL;
		if (info->bitmask & XT_PHYSDEV_OP_OUT &&
		if (info->bitmask & (XT_PHYSDEV_OP_OUT \| XT_PHYSDEV_OP_ISOUT) &&
		(!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) \|\|
		info->invert & XT_PHYSDEV_OP_BRIDGED) &&
		par->hook_mask & ((1 << NF_INET_LOCAL_OUT) \|
		(1 << NF_INET_FORWARD) \| (1 << NF_INET_POST_ROUTING))) {
		pr_info("using --physdev-out in the OUTPUT, FORWARD and "
		"POSTROUTING chains for non-bridged traffic is not "
		"supported anymore.\n");
		pr_info("using --physdev-out and --physdev-is-out are only"
		"supported in the FORWARD and POSTROUTING chains with"
		"bridged traffic.\n");
		if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
		return -EINVAL;
		}

Admin message