bridge: Validate that vlan is permitted on ingress

[~andy/linux] / net / bridge / br_input.c

diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 4b34207419b1cfbe39ca54321cf9087101bab155..4ef3f6b17bd036520f4b533a5818a4da244ca3a3 100644 (file)
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -17,6 +17,7 @@
 #include <linux/etherdevice.h>
 #include <linux/netfilter_bridge.h>
 #include <linux/export.h>
+#include <linux/rculist.h>
 #include "br_private.h"
 
 /* Hook for brouter */
@@ -54,6 +55,9 @@ int br_handle_frame_finish(struct sk_buff *skb)
        if (!p || p->state == BR_STATE_DISABLED)
                goto drop;
 
+       if (!br_allowed_ingress(p->br, nbp_get_vlan_info(p), skb))
+               goto drop;
+
        /* insert into forwarding database after filtering to avoid spoofing */
        br = p->br;
        br_fdb_update(br, p, eth_hdr(skb)->h_source);