Re: [Ebtables-user] bridge/ebtables interaction...

On Mon, 23 May 2005 20:21:34 +0000
Bart De Schuymer <[email protected]> wrote:

> Op ma, 23-05-2005 te 11:51 -0400, schreef Jon Anderson:
> > Bart De Schuymer wrote:
> > 
> > >Just add the call to the brouting chain in the function
> > >br_handle_frame_continue as the first code inside the
> > >BR_STATE_FORWARDING if construct. That way, you introduce a new chain
> > >without breaking anything.
> > >
> > I'm uncertain about the behavior of okfn in the hook. (I couldn't find
> > any documentation about okfn.) In br_handle_frame, returning 0 means the
> > packet should be processed further, returning 1 means it was handled;
> > the brouting stuff returns 0, and everything else returns 1.
> 
> I am not in favor of adding a new NF_HOOK to the kernel. The chain call
> length is long enough as it is.
> 
> I think something similar to the way the BROUTING chain is called should
> be preferred. It's similar to an NF_HOOK call, but has the advantage
> that the chain call length isn't increased. Something like this (adding
> the appropriate code elsewhere):
> 
> --- net/bridge/br_input.c.old	2005-05-23 20:04:30.651219488 +0000
> +++ net/bridge/br_input.c	2005-05-23 20:10:11.493403600 +0000
> @@ -109,8 +109,16 @@ int br_handle_frame(struct net_bridge_po
>  		goto err;
>  
>  	if (p->state == BR_STATE_LEARNING ||
> -	    p->state == BR_STATE_FORWARDING)
> +	    p->state == BR_STATE_FORWARDING) {
> +		if (br_intial_hook) {
> +			if (br_initial_hook(pskb)) { /* Should only be used for filtering,
> +			                              * so the skb should not have changed */
> +				kfree_skb(*pskb);
> +				return 0;
> +			}
> +		}
>  		br_fdb_insert(p->br, p, eth_hdr(skb)->h_source, 0);
> +	}
>  
>  	if (p->br->stp_enabled &&
>  	    !memcmp(dest, bridge_ula, 5) &&
> 
> 
> Stephen, would you have any objection to something like the above?

I have no objection to hook changes as long as:
	* it addresses a real need that can't be satisfied in other ways
	* it can be supported reasonably by tools: would ebtables handle this?
	* it is safe for non-hook users and doesn't kill the performance

> > Also, should this discussion be moved to the devel list?
> 
> Done.
> 
> cheers,
> Bart
> 


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click