diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2009-01-12 00:06:03 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-01-12 21:18:34 -0800 |
| commit | 47e0e1ca13d64eeeb687995fbe4e239e743d7544 (patch) | |
| tree | ea069732dc87dca81fc2c5a405320c0fc518096e /net/bridge/netfilter | |
| parent | a2bd40ad3151d4d346fd167e01fb84b06f7247fc (diff) | |
| download | op-kernel-dev-47e0e1ca13d64eeeb687995fbe4e239e743d7544.zip op-kernel-dev-47e0e1ca13d64eeeb687995fbe4e239e743d7544.tar.gz | |
netfilter 03/09: bridge: Disable PPPOE/VLAN processing by default
The PPPOE/VLAN processing code in the bridge netfilter is broken
by design. The VLAN tag and the PPPOE session ID are an integral
part of the packet flow information, yet they're completely
ignored by the bridge netfilter. This is potentially a security
hole as it treats all VLANs and PPPOE sessions as the same.
What's more, it's actually broken for PPPOE as the bridge netfilter
tries to trim the packets to the IP length without adjusting the
PPPOE header (and adjusting the PPPOE header isn't much better
since the PPPOE peer may require the padding to be present).
Therefore we should disable this by default.
It does mean that people relying on this feature may lose networking
depending on how their bridge netfilter rules are configured.
However, IMHO the problems this code causes are serious enough to
warrant this.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge/netfilter')
0 files changed, 0 insertions, 0 deletions
