netfilter: ipv6: add IPSKB_REROUTED exclusion to NF_HOOK/POSTROUTING invocation

[net-next-2.6.git] / net / bridge / br_netfilter.c

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 268e2e7258881addf26214bb4418382ba3228c97..dd6f538ba0b0b4cb56238bd60c7ba36476b9f522 100644 (file)
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -3,15 +3,8 @@
  *     Linux ethernet bridge
  *
  *     Authors:
- *     Lennert Buytenhek               <buytenh@gnu.org>
- *     Bart De Schuymer (maintainer)   <bdschuym@pandora.be>
- *
- *     Changes:
- *     Apr 29 2003: physdev module support (bdschuym)
- *     Jun 19 2003: let arptables see bridged ARP traffic (bdschuym)
- *     Oct 06 2003: filter encapsulated IP/ARP VLAN traffic on untagged bridge
- *                  (bdschuym)
- *     Sep 01 2004: add IPv6 filtering (bdschuym)
+ *     Lennert Buytenhek               <buytenh@gnu.org>
+ *     Bart De Schuymer                <bdschuym@pandora.be>
  *
  *     This program is free software; you can redistribute it and/or
  *     modify it under the terms of the GNU General Public License
@@ -246,23 +239,12 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
 
        skb->dev = nf_bridge->physindev;
        nf_bridge_push_encap_header(skb);
-       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
+       NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
                       br_handle_frame_finish, 1);
 
        return 0;
 }
 
-static void __br_dnat_complain(void)
-{
-       static unsigned long last_complaint;
-
-       if (jiffies - last_complaint >= 5 * HZ) {
-               printk(KERN_WARNING "Performing cross-bridge DNAT requires IP "
-                      "forwarding to be enabled\n");
-               last_complaint = jiffies;
-       }
-}
-
 /* This requires some explaining. If DNAT has taken place,
  * we will need to fix up the destination Ethernet address,
  * and this is a tricky process.
@@ -378,11 +360,6 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
                                        skb_dst_set(skb, (struct dst_entry *)rt);
                                        goto bridged_dnat;
                                }
-                               /* we are sure that forwarding is disabled, so printing
-                                * this message is no problem. Note that the packet could
-                                * still have a martian destination address, in which case
-                                * the packet could be dropped even if forwarding were enabled */
-                               __br_dnat_complain();
                                dst_release((struct dst_entry *)rt);
                        }
 free_skb:
@@ -396,7 +373,8 @@ bridged_dnat:
                                nf_bridge->mask |= BRNF_BRIDGED_DNAT;
                                skb->dev = nf_bridge->physindev;
                                nf_bridge_push_encap_header(skb);
-                               NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING,
+                               NF_HOOK_THRESH(NFPROTO_BRIDGE,
+                                              NF_BR_PRE_ROUTING,
                                               skb, skb->dev, NULL,
                                               br_nf_pre_routing_finish_bridge,
                                               1);
@@ -417,7 +395,7 @@ bridged_dnat:
 
        skb->dev = nf_bridge->physindev;
        nf_bridge_push_encap_header(skb);
-       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
+       NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
                       br_handle_frame_finish, 1);
 
        return 0;
@@ -534,7 +512,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
        if (!setup_pre_routing(skb))
                return NF_DROP;
 
-       NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
+       NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
                br_nf_pre_routing_finish_ipv6);
 
        return NF_STOLEN;
@@ -607,7 +585,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
                return NF_DROP;
        store_orig_dstaddr(skb);
 
-       NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
+       NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
                br_nf_pre_routing_finish);
 
        return NF_STOLEN;
@@ -655,7 +633,7 @@ static int br_nf_forward_finish(struct sk_buff *skb)
                in = *((struct net_device **)(skb->cb));
        }
        nf_bridge_push_encap_header(skb);
-       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_FORWARD, skb, in,
+       NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,
                       skb->dev, br_forward_finish, 1);
        return 0;
 }
@@ -786,7 +764,7 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff *skb,
        }
        nf_bridge_push_encap_header(skb);
 
-       NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev, skb->dev,
+       NF_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, realindev, skb->dev,
                br_forward_finish);
        return NF_STOLEN;
 }
@@ -819,17 +797,6 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
        struct net_device *realoutdev = bridge_parent(skb->dev);
        u_int8_t pf;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-       /* Be very paranoid. This probably won't happen anymore, but let's
-        * keep the check just to be sure... */
-       if (skb_mac_header(skb) < skb->head ||
-           skb_mac_header(skb) + ETH_HLEN > skb->data) {
-               printk(KERN_CRIT "br_netfilter: Argh!! br_nf_post_routing: "
-                      "bad mac.raw pointer.\n");
-               goto print_error;
-       }
-#endif
-
        if (!nf_bridge)
                return NF_ACCEPT;
 
@@ -848,13 +815,6 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
        else
                return NF_ACCEPT;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-       if (skb_dst(skb) == NULL) {
-               printk(KERN_INFO "br_netfilter post_routing: skb->dst == NULL\n");
-               goto print_error;
-       }
-#endif
-
        /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
         * about the value of skb->pkt_type. */
        if (skb->pkt_type == PACKET_OTHERHOST) {
@@ -869,19 +829,6 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
                br_nf_dev_queue_xmit);
 
        return NF_STOLEN;
-
-#ifdef CONFIG_NETFILTER_DEBUG
-print_error:
-       if (skb->dev != NULL) {
-               printk("[%s]", skb->dev->name);
-               if (realoutdev)
-                       printk("[%s]", realoutdev->name);
-       }
-       printk(" head:%p, raw:%p, data:%p\n", skb->head, skb_mac_header(skb),
-              skb->data);
-       dump_stack();
-       return NF_ACCEPT;
-#endif
 }
 
 /* IP/SABOTAGE *****************************************************/