Commit e9c284ec authored May 06, 2020 by Michael Braun Committed by Pablo Neira Ayuso May 25, 2020

netfilter: nft_reject_bridge: enable reject with bridge vlan



Currently, using the bridge reject target with tagged packets
results in untagged packets being sent back.

Fix this by mirroring the vlan id as well.

Fixes: 85f5b308 ("netfilter: bridge: add reject support")
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 98790bba

net/bridge/netfilter/nft_reject_bridge.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -31,6 +31,12 @@ static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
		ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
		eth->h_proto = eth_hdr(oldskb)->h_proto;
		skb_pull(nskb, ETH_HLEN);

		if (skb_vlan_tag_present(oldskb)) {
		u16 vid = skb_vlan_tag_get(oldskb);

		__vlan_hwaccel_put_tag(nskb, oldskb->vlan_proto, vid);
		}
		}

		static int nft_bridge_iphdr_validate(struct sk_buff *skb)

Admin message