Commit 11577134 authored by David Ahern's avatar David Ahern Committed by Greg Kroah-Hartman

netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev

[ Upstream commit a173f066 ]

For starters, the bridge netfilter code registers operations that
are invoked any time nh_hook is called. Specifically, ip_sabotage_in
watches for nested calls for NF_INET_PRE_ROUTING when a bridge is in
the stack.

Packet wise, the bridge netfilter hook runs first. br_nf_pre_routing
allocates nf_bridge, sets in_prerouting to 1 and calls NF_HOOK for
NF_INET_PRE_ROUTING. It's finish function, br_nf_pre_routing_finish,
then resets in_prerouting flag to 0 and the packet continues up the
stack. The packet eventually makes it to the VRF driver and it invokes
nf_hook for NF_INET_PRE_ROUTING in case any rules have been added against
the vrf device.

Because of the registered operations the call to nf_hook causes
ip_sabotage_in to be invoked. That function sees the nf_bridge on the
skb and that in_prerouting is not set. Thinking it is an invalid nested
call it steals (drops) the packet.

Update ip_sabotage_in to recognize that the bridge or one of its upper
devices (e.g., vlan) can be enslaved to a VRF (L3 master device) and
allow the packet to go through the nf_hook a second time.

Fixes: 73e20b76 ("net: vrf: Add support for PREROUTING rules on vrf device")
Reported-by: default avatarD'Souza, Nelson <>
Signed-off-by: default avatarDavid Ahern <>
Signed-off-by: default avatarPablo Neira Ayuso <>
Signed-off-by: default avatarSasha Levin <>
parent 26c6b9da
......@@ -832,7 +832,8 @@ static unsigned int ip_sabotage_in(void *priv,
struct sk_buff *skb,
const struct nf_hook_state *state)
if (skb->nf_bridge && !skb->nf_bridge->in_prerouting) {
if (skb->nf_bridge && !skb->nf_bridge->in_prerouting &&
!netif_is_l3_master(skb->dev)) {
state->okfn(state->net, state->sk, skb);
return NF_STOLEN;
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment