Re: [Ebtables-user] bridge/ebtables interaction...

Stephen Hemminger wrote:

>I have no objection to hook changes as long as:
>	* it addresses a real need that can't be satisfied in other ways
>  
>
I guess you missed the problem I was having to begin with. A host on the
'wrong' side of the bridge can send from a spoofed mac, and it will
cause the bridge to send data to the 'wrong' port, rather than where the
original host really is.

Of the potential other ways to fix the problem, patching ebtables was
the simplest and least intrusive.

>	* it can be supported reasonably by tools: would ebtables handle this?
>  
>
My hack seems to work fine. I think you guys seriously deserve some
applause for making the system so easy to modify.

>	* it is safe for non-hook users and doesn't kill the performance
>  
>
If you're worried about performance, I can #ifdef out the initial stuff
if the Kconfig var hasn't been selected. Otherwise, if someone isn't
using the table, it is just one if statement.

I'm going to send along some patches shortly (to ebtables-devel only).
They should do basically what you'd expect based on previous discussion.

Thanks for all the help.

Cheers,

jon


-------------------------------------------------------
This SF.Net email is sponsored by Yahoo.
Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
Search APIs Find out how you can build Yahoo! directly into your own
Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005