Merge to Fedora kernel-2.6.18-1.2224_FC5 patched with stable patch-2.6.18.1-vs2.0...

[linux-2.6.git] / net / netfilter / xt_physdev.c

diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 5fe4c9d..63a9654 100644 (file)
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -10,6 +10,7 @@
 
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter/xt_physdev.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge.h>
@@ -113,6 +114,21 @@ checkentry(const char *tablename,
        if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
            info->bitmask & ~XT_PHYSDEV_OP_MASK)
                return 0;
+       if (brnf_deferred_hooks == 0 &&
+           info->bitmask & XT_PHYSDEV_OP_OUT &&
+           (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
+            info->invert & XT_PHYSDEV_OP_BRIDGED) &&
+           hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
+                        (1 << NF_IP_POST_ROUTING))) {
+               printk(KERN_WARNING "physdev match: using --physdev-out in the "
+                      "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
+                      "traffic is deprecated and breaks other things, it will "
+                      "be removed in January 2007. See Documentation/"
+                      "feature-removal-schedule.txt for details. This doesn't "
+                      "affect you in case you're using it for purely bridged "
+                      "traffic.\n");
+               brnf_deferred_hooks = 1;
+       }
        return 1;
 }