Re: Re: [Ebtables-user] bridge/ebtables interaction...

Op wo, 31-08-2005 te 11:53 -0700, schreef Stephen Hemminger:
> Wouldn't something like this work:
> 
> Index: bridge-2.6/net/bridge/br_input.c
> ===================================================================
> --- bridge-2.6.orig/net/bridge/br_input.c
> +++ bridge-2.6/net/bridge/br_input.c
> @@ -53,6 +53,11 @@ int br_handle_frame_finish(struct sk_buf
>  	/* insert into forwarding database after filtering to avoid spoofing */
>  	br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
>  
> +	if (p->state == BR_STATE_LEARNING) {
> +		kfree_skb(skb);
> +		goto out;
> +	}
> +
>  	if (br->dev->flags & IFF_PROMISC) {
>  		struct sk_buff *skb2;
>  
> @@ -107,9 +112,6 @@ int br_handle_frame(struct net_bridge_po
>  	if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
>  		goto err;
>  
> -	if (p->state == BR_STATE_LEARNING)
> -		br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
> -
>  	if (p->br->stp_enabled &&
>  	    !memcmp(dest, bridge_ula, 5) &&
>  	    !(dest[5] & 0xF0)) {
> @@ -118,9 +120,10 @@ int br_handle_frame(struct net_bridge_po
>  				NULL, br_stp_handle_bpdu);
>  			return 1;
>  		}
> +		goto err;
>  	}
>  
> -	else if (p->state == BR_STATE_FORWARDING) {
> +	if (p->state == BR_STATE_FORWARDING || p->state == BR_STATE_LEARNING) {
>  		if (br_should_route_hook) {
>  			if (br_should_route_hook(pskb)) 
>  				return 0;

I don't think the broute table should see packets while in learning
state, and it certainly shouldn't be able to make them be routed.
Perhaps it's ok to let this traffic be seen on the PRE_ROUTING hook, but
that means that, e.g., iptables connection tracking will see these
(IPv4) packets. Also, letting the packets not be seen by the broute
table while letting them be seen on the PRE_ROUTING hook sounds like an
ugly hack...
Apart from that, some people would perhaps like the fact that they can
make rules to decide which packets can update the fdb. Of course,
ebtables targets like snat, dnat, redirect would not be allowed.

cheers,
Bart




-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf