[NETFILTER]: bridge netfilter: add deferred output hooks to feature-removal-schedule

Add bridge netfilter deferred output hooks to feature-removal-schedule
and disable them by default. Until their removal they will be
activated by the physdev match when needed.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 9d3a077..87851ef 100644 (file)
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -258,3 +258,19 @@ Why:       These drivers never compiled since they were added to the kernel
 Who:   Jean Delvare <khali@linux-fr.org>
 
 ---------------------------
+
+What:  Bridge netfilter deferred IPv4/IPv6 output hook calling
+When:  January 2007
+Why:   The deferred output hooks are a layering violation causing unusual
+       and broken behaviour on bridge devices. Examples of things they
+       break include QoS classifation using the MARK or CLASSIFY targets,
+       the IPsec policy match and connection tracking with VLANs on a
+       bridge. Their only use is to enable bridge output port filtering
+       within iptables with the physdev match, which can also be done by
+       combining iptables and ebtables using netfilter marks. Until it
+       will get removed the hook deferral is disabled by default and is
+       only enabled when needed.
+
+Who:   Patrick McHardy <kaber@trash.net>
+
+---------------------------

diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 8776402..31f02ba 100644 (file)
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -79,6 +79,8 @@ struct bridge_skb_cb {
                __u32 ipv4;
        } daddr;
 };
+
+extern int brnf_deferred_hooks;
 #endif /* CONFIG_BRIDGE_NETFILTER */
 
 #endif /* __KERNEL__ */

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index cbc8a38..05b3de8 100644 (file)
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -61,6 +61,9 @@ static int brnf_filter_vlan_tagged = 1;
 #define brnf_filter_vlan_tagged 1
 #endif
 
+int brnf_deferred_hooks;
+EXPORT_SYMBOL_GPL(brnf_deferred_hooks);
+
 static __be16 inline vlan_proto(const struct sk_buff *skb)
 {
        return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
@@ -890,6 +893,8 @@ static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
                                return NF_ACCEPT;
                        else if (ip->version == 6 && !brnf_call_ip6tables)
                                return NF_ACCEPT;
+                       else if (!brnf_deferred_hooks)
+                               return NF_ACCEPT;
 #endif
                        if (hook == NF_IP_POST_ROUTING)
                                return NF_ACCEPT;

diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 5fe4c9d..a9f4f6f 100644 (file)
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -113,6 +113,21 @@ checkentry(const char *tablename,
        if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
            info->bitmask & ~XT_PHYSDEV_OP_MASK)
                return 0;
+       if (brnf_deferred_hooks == 0 &&
+           info->bitmask & XT_PHYSDEV_OP_OUT &&
+           (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
+            info->invert & XT_PHYSDEV_OP_BRIDGED) &&
+           hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
+                        (1 << NF_IP_POST_ROUTING))) {
+               printk(KERN_WARNING "physdev match: using --physdev-out in the "
+                      "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
+                      "traffic is deprecated and breaks other things, it will "
+                      "be removed in January 2007. See Documentation/"
+                      "feature-removal-schedule.txt for details. This doesn't "
+                      "affect you in case you're using it for purely bridged "
+                      "traffic.\n");
+               brnf_deferred_hooks = 1;
+       }
        return 1;
 }