Re: Re: [Ebtables-user] bridge/ebtables interaction...

Op do, 01-09-2005 te 09:26 -0700, schreef Stephen Hemminger:
> > I don't think the broute table should see packets while in learning
> > state, and it certainly shouldn't be able to make them be routed.
> > Perhaps it's ok to let this traffic be seen on the PRE_ROUTING hook, but
> > that means that, e.g., iptables connection tracking will see these
> > (IPv4) packets. Also, letting the packets not be seen by the broute
> > table while letting them be seen on the PRE_ROUTING hook sounds like an
> > ugly hack...
> > Apart from that, some people would perhaps like the fact that they can
> > make rules to decide which packets can update the fdb. Of course,
> > ebtables targets like snat, dnat, redirect would not be allowed.
> 
> We could pass the state to should_route_hook and let it decide?

No need to postpone the decision to should_route_hook. This should do:
if (br_should_route_hook && p->state != BR_STATE_LEARNING)

Note that the brouting chain cannot decide to drop the packet, it
decides whether to bridge or route the packet.

Doing this will mean that those packets are seen on prerouting without
being seen on brouting. It'll confuse the users and it's not aestetic.
Furthermore it will make connection tracking do unnecessary work. I
don't know if it's really worth that...

cheers,
Bart




-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf