Re: 2.6.12: connection tracking broken?

"David S. Miller" <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.devel,gmane.linux.kernel,gmane.linux.network.bridge.ebtables.devel
Message-ID <[email protected]> 
From: Herbert Xu <[email protected]>
Date: Mon, 20 Jun 2005 10:05:42 +1000

> Patrick McHardy <[email protected]> wrote:
> >
> > The bridge-netfilter code defers calling of some NF_IP_* hooks to the
> > bridge layer, when the conntrack reference is already gone, so the entry
> 
> Why does it defer them at all? Shouldn't the fact that the device is
> bridged be transparent to the IP layer?

The bridge netfilter layer uses netif_rx(skb) at the deepest level in
order to avoid too deep stack usage.

This is also why the NF_HOOK*() macros were semantically changed
a little bit several months ago.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.