netfilter: explicit module dependency between br_netfilter and physdev
You can use physdev to match the physical interface enslaved to the
bridge device. This information is stored in skb->nf_bridge and it is
set up by br_netfilter. So, this is only available when iptables is
used from the bridge netfilter path.
Since 34666d4
("netfilter: bridge: move br_netfilter out of the core"),
the br_netfilter code is modular. To reduce the impact of this change,
we can autoload the br_netfilter if the physdev match is used since
we assume that the users need br_netfilter in place.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Родитель
36d2af5998
Коммит
4b7fd5d97e
|
@ -0,0 +1,6 @@
|
|||
#ifndef _BR_NETFILTER_H_
|
||||
#define _BR_NETFILTER_H_
|
||||
|
||||
void br_netfilter_enable(void);
|
||||
|
||||
#endif /* _BR_NETFILTER_H_ */
|
|
@ -856,6 +856,11 @@ static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops,
|
|||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
void br_netfilter_enable(void)
|
||||
{
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(br_netfilter_enable);
|
||||
|
||||
/* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
|
||||
* br_dev_queue_push_xmit is called afterwards */
|
||||
static struct nf_hook_ops br_nf_ops[] __read_mostly = {
|
||||
|
|
|
@ -13,6 +13,7 @@
|
|||
#include <linux/netfilter_bridge.h>
|
||||
#include <linux/netfilter/xt_physdev.h>
|
||||
#include <linux/netfilter/x_tables.h>
|
||||
#include <net/netfilter/br_netfilter.h>
|
||||
|
||||
MODULE_LICENSE("GPL");
|
||||
MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
|
||||
|
@ -87,6 +88,8 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
|
|||
{
|
||||
const struct xt_physdev_info *info = par->matchinfo;
|
||||
|
||||
br_netfilter_enable();
|
||||
|
||||
if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
|
||||
info->bitmask & ~XT_PHYSDEV_OP_MASK)
|
||||
return -EINVAL;
|
||||
|
|
Загрузка…
Ссылка в новой задаче