Re: bridge/ebtables interaction...

Bart De Schuymer wrote:

>I'd prefer a solution where no chain is added.
>I don't know if the 802.1 standard demands that the fdb is updated even
>if the bridge is not in forwarding state. My opinion is that the
>PREROUTING chain should be traversed before the fdb is updated. But
>that's up to the bridge maintainer Stephen Hemminger.
>  
>
Well, the nat table in the prerouting chain isn't really appropriate for 
filtering incoming frames anyway...is it?

>If a new chain is added, then it should be a chain of a new table, like
>the brouting table (which also has only one chain).
>  
>
That makes much more sense to me. Would the addition of a 'raw' or 
'initial' table be suitable, with only one INPUT chain?

>FYI, your patch isn't completely right. A quick scan shows the brouting
>chain isn't called at the right time. Note that it is unsafe to do
>anything with the skb after a NF_HOOK call. I'd be surprised if you
>don't get an oops when you use the BROUTING chain.
>  
>
Yep, I think I even mentioned something about not being sure how to 
handle the brouting part properly. The only (simple) way I can think of 
to handle it would be to make the new table/chain and brouting mutually 
exclusive.

>It's also a bad idea to change all the hook numbers if you add a new
>one, just make NF_BR_INITIAL 6.
>  
>
I just stuck it there 'cause it would be logically the first chain to be 
traversed. I will change that as well.

Thanks for your input. Hopefully now I can turn the patch from a quick 
hack into something halfway decent.

Cheers,

Jon


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click