Re: Re: [Ebtables-user] bridge/ebtables interaction...

On Thu, 01 Sep 2005 06:59:37 +0000
Bart De Schuymer <[email protected]> wrote:

> Op wo, 31-08-2005 te 11:53 -0700, schreef Stephen Hemminger:
> > Wouldn't something like this work:
> > 
> > Index: bridge-2.6/net/bridge/br_input.c
> > ===================================================================
> > --- bridge-2.6.orig/net/bridge/br_input.c
> > +++ bridge-2.6/net/bridge/br_input.c
> > @@ -53,6 +53,11 @@ int br_handle_frame_finish(struct sk_buf
> >  	/* insert into forwarding database after filtering to avoid spoofing */
> >  	br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
> >  
> > +	if (p->state == BR_STATE_LEARNING) {
> > +		kfree_skb(skb);
> > +		goto out;
> > +	}
> > +
> >  	if (br->dev->flags & IFF_PROMISC) {
> >  		struct sk_buff *skb2;
> >  
> > @@ -107,9 +112,6 @@ int br_handle_frame(struct net_bridge_po
> >  	if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
> >  		goto err;
> >  
> > -	if (p->state == BR_STATE_LEARNING)
> > -		br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
> > -
> >  	if (p->br->stp_enabled &&
> >  	    !memcmp(dest, bridge_ula, 5) &&
> >  	    !(dest[5] & 0xF0)) {
> > @@ -118,9 +120,10 @@ int br_handle_frame(struct net_bridge_po
> >  				NULL, br_stp_handle_bpdu);
> >  			return 1;
> >  		}
> > +		goto err;
> >  	}
> >  
> > -	else if (p->state == BR_STATE_FORWARDING) {
> > +	if (p->state == BR_STATE_FORWARDING || p->state == BR_STATE_LEARNING) {
> >  		if (br_should_route_hook) {
> >  			if (br_should_route_hook(pskb)) 
> >  				return 0;
> 
> I don't think the broute table should see packets while in learning
> state, and it certainly shouldn't be able to make them be routed.
> Perhaps it's ok to let this traffic be seen on the PRE_ROUTING hook, but
> that means that, e.g., iptables connection tracking will see these
> (IPv4) packets. Also, letting the packets not be seen by the broute
> table while letting them be seen on the PRE_ROUTING hook sounds like an
> ugly hack...
> Apart from that, some people would perhaps like the fact that they can
> make rules to decide which packets can update the fdb. Of course,
> ebtables targets like snat, dnat, redirect would not be allowed.

We could pass the state to should_route_hook and let it decide?


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf