Huajian Yang aa04c6f45b netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it ...

The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for
fragmented packets.

The original bridge does not know that it is a fragmented packet and
forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function
nf_br_ip_fragment and br_ip6_fragment will check the headroom.

In original br_forward, insufficient headroom of skb may indeed exist,
but there's still a way to save the skb in the device driver after
dev_queue_xmit.So droping the skb will change the original bridge
forwarding in some cases.

Fixes: 3c171f496e ("netfilter: bridge: add connection tracking system")
Signed-off-by: Huajian Yang <[email protected]>
Reviewed-by: Florian Westphal <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>

2025-05-05 13:13:08 +02:00

..

ebt_802_3.c

…

ebt_among.c

…

ebt_arp.c

…

ebt_arpreply.c

…

ebt_dnat.c

…

ebt_ip6.c

…

ebt_ip.c

…

ebt_limit.c

…

ebt_log.c

…

ebt_mark_m.c

…

ebt_mark.c

…

ebt_nflog.c

…

ebt_pkttype.c

…

ebt_redirect.c

…

ebt_snat.c

…

ebt_stp.c

…

ebt_vlan.c

…

ebtable_broute.c

…

ebtable_filter.c

…

ebtable_nat.c

…

ebtables.c

netfilter: Use kmemdup_array instead of kmemdup for multiple allocation

2024-09-03 10:47:16 +02:00

Kconfig

netfilter: Make legacy configs user selectable

2024-10-15 10:00:24 +02:00

Makefile

netfilter: ebtables: allow xtables-nft only builds

2024-01-29 15:43:21 +01:00

nf_conntrack_bridge.c

netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it

2025-05-05 13:13:08 +02:00

nft_meta_bridge.c

netfilter: nf_tables: replace deprecated strncpy with strscpy_pad

2024-10-15 17:29:51 +02:00

nft_reject_bridge.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00