From: Patrick McHardy Date: Sat, 12 Jan 2008 02:02:18 +0000 (-0800) Subject: [NETFILTER]: bridge: fix double POST_ROUTING invocation X-Git-Tag: v2.6.24-rc8~7^2~1 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2948d2ebbb98747b912ac6d0c864b4d02be8a6f5;p=pandora-kernel.git [NETFILTER]: bridge: fix double POST_ROUTING invocation The bridge code incorrectly causes two POST_ROUTING hook invocations for DNATed packets that end up on the same bridge device. This happens because packets with a changed destination address are passed to dst_output() to make them go through the neighbour output function again to build a new destination MAC address, before they will continue through the IP hooks simulated by bridge netfilter. The resulting hook order is: PREROUTING (bridge netfilter) POSTROUTING (dst_output -> ip_output) FORWARD (bridge netfilter) POSTROUTING (bridge netfilter) The deferred hooks used to abort the first POST_ROUTING invocation, but since the only thing bridge netfilter actually really wants is a new MAC address, we can avoid going through the IP stack completely by simply calling the neighbour output function directly. Tested, reported and lots of data provided by: Damien Thebault Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- Reading git-diff-tree failed