Re: bridge/ebtables interaction...

Op vr, 20-05-2005 te 17:30 -0400, schreef Jon Anderson:
> And I sent this from the wrong email address again - sending again from the right one so this actually gets to the list. Sorry!
> 
> Bart De Schuymer wrote:
> 
> >>Not that I know of. Perhaps the call to br_fdb_update() in
> >>net/bridge/br_input.c should be postponed until after the PREROUTING
> >>hook. The fdb update is even done before the BROUTING chain is
> >>traversed...
> >>
> >  
> >
> Alright, I wrote a patch...I wasn't sure how to handle the brouting
> stuff, so it's a little hackish, but it seems to work for what I'm
> trying to do.
> 
> Now, just after the checking but before the br_fdb_insert I've added
> another chain to the filter table called INITIAL.
> 
> So instead of:
>     incoming frame-->bridge-->prerouting-->etc.
> It's:
>     incoming frame-->initial-->bridge-->prerouting->etc.
> 
> If I put the right rules into the INITIAL chain, the bridge ports no
> longer get updated by packets coming in on the wrong interface.
> 
> I've attached two patches, one for the kernelspace stuff and the
> userspace stuff. (I know there are usually rules to posting these, but I
> wanted to get them out before the weekend, so no time for reading about
> etiquette!  ;-) 
> 
> Comments please!

I'd prefer a solution where no chain is added.
I don't know if the 802.1 standard demands that the fdb is updated even
if the bridge is not in forwarding state. My opinion is that the
PREROUTING chain should be traversed before the fdb is updated. But
that's up to the bridge maintainer Stephen Hemminger.

If a new chain is added, then it should be a chain of a new table, like
the brouting table (which also has only one chain).

FYI, your patch isn't completely right. A quick scan shows the brouting
chain isn't called at the right time. Note that it is unsafe to do
anything with the skb after a NF_HOOK call. I'd be surprised if you
don't get an oops when you use the BROUTING chain.
It's also a bad idea to change all the hook numbers if you add a new
one, just make NF_BR_INITIAL 6.

cheers,
Bart




-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click