Skip to content

netfilter: nft_reject_bridge: Fix for missing reply from prerouting

Phil Sutter requested to merge psutter1/centos-stream-9:rhel9/bz2044848 into main

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2044848 Upstream Status: nf.git commit aeac4554eb549

commit aeac4554eb549037ff2f719200c0a9c1c25e7eaa Author: Phil Sutter phil@nwl.cc Date: Tue Jan 25 20:06:03 2022 +0100

netfilter: nft_reject_bridge: Fix for missing reply from prerouting

Prior to commit fa538f7cf05aa ("netfilter: nf_reject: add reject skbuff
creation helpers"), nft_reject_bridge did not assign to nskb->dev before
passing nskb on to br_forward(). The shared skbuff creation helpers
introduced in above commit do which seems to confuse br_forward() as
reject statements in prerouting hook won't emit a packet anymore.

Fix this by simply passing NULL instead of 'dev' to the helpers - they
use the pointer for just that assignment, nothing else.

Fixes: fa538f7cf05aa ("netfilter: nf_reject: add reject skbuff creation helpers")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Phil Sutter psutter@redhat.com

Merge request reports