Huajian Yang aa04c6f45b netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it ...

The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for
fragmented packets.

The original bridge does not know that it is a fragmented packet and
forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function
nf_br_ip_fragment and br_ip6_fragment will check the headroom.

In original br_forward, insufficient headroom of skb may indeed exist,
but there's still a way to save the skb in the device driver after
dev_queue_xmit.So droping the skb will change the original bridge
forwarding in some cases.

Fixes: 3c171f496e ("netfilter: bridge: add connection tracking system")
Signed-off-by: Huajian Yang <huajianyang@asrmicro.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2025-05-05 13:13:08 +02:00

..

ebt_802_3.c

netfilter: inline xt_hashlimit, ebt_802_3 and xt_physdev headers

2019-09-13 12:32:48 +02:00

ebt_among.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

ebt_arp.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

ebt_arpreply.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

ebt_dnat.c

netfilter: ebtables: Fixes dropping of small packets in bridge nat

2020-10-20 13:54:53 +02:00

ebt_ip6.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

ebt_ip.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

ebt_limit.c

netfilter: allow to turn off xtables compat layer

2021-04-26 18:16:56 +02:00

ebt_log.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

ebt_mark_m.c

netfilter: allow to turn off xtables compat layer

2021-04-26 18:16:56 +02:00

ebt_mark.c

netfilter: allow to turn off xtables compat layer

2021-04-26 18:16:56 +02:00

ebt_nflog.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

ebt_pkttype.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

ebt_redirect.c

netfilter: ebtables: Fixes dropping of small packets in bridge nat

2020-10-20 13:54:53 +02:00

ebt_snat.c

netfilter: ebtables: Fixes dropping of small packets in bridge nat

2020-10-20 13:54:53 +02:00

ebt_stp.c

netfilter: ebt_stp: Remove unused macro BPDU_TYPE_TCN

2020-09-08 12:56:38 +02:00

ebt_vlan.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13

2019-05-21 11:28:45 +02:00

ebtable_broute.c

netfilter: add missing module descriptions

2023-11-08 13:52:32 +01:00

ebtable_filter.c

netfilter: add missing module descriptions

2023-11-08 13:52:32 +01:00

ebtable_nat.c

netfilter: add missing module descriptions

2023-11-08 13:52:32 +01:00

ebtables.c

netfilter: Use kmemdup_array instead of kmemdup for multiple allocation

2024-09-03 10:47:16 +02:00

Kconfig

netfilter: Make legacy configs user selectable

2024-10-15 10:00:24 +02:00

Makefile

netfilter: ebtables: allow xtables-nft only builds

2024-01-29 15:43:21 +01:00

nf_conntrack_bridge.c

netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it

2025-05-05 13:13:08 +02:00

nft_meta_bridge.c

netfilter: nf_tables: replace deprecated strncpy with strscpy_pad

2024-10-15 17:29:51 +02:00

nft_reject_bridge.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00