From: Florian Westphal <fw@strlen.de>
Date: Thu, 24 Oct 2013 19:32:42 +0000 (+0200)
Subject: bridge: netfilter: orphan skb before invoking ip netfilter hooks
X-Git-Tag: v3.13-rc1~105^2~64^2~4
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6b8dbcf2c44fd7aa716560d04e9857c870bd510c;p=pandora-kernel.git

bridge: netfilter: orphan skb before invoking ip netfilter hooks

Pekka Pietikäinen reports xt_socket behavioural change after commit
00028aa37098o (netfilter: xt_socket: use IP early demux).

Reason is xt_socket now no longer does an unconditional sk lookup -
it re-uses existing skb->sk if possible, assuming ->sk was set by
ip early demux.

However, when netfilter is invoked via bridge, this can cause 'bogus'
sockets to be examined by the match, e.g. a 'tun' device socket.

bridge netfilter should orphan the skb just like the routing path
before invoking ipv4/ipv6 netfilter hooks to avoid this.

Reported-and-tested-by: Pekka Pietikäinen <pp@ee.oulu.fi>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

Reading git-diff-tree failed