Re: bridge/ebtables interaction...

Op za, 21-05-2005 te 20:00 -0400, schreef Jon Anderson:
> Bart De Schuymer wrote:
> 
> >I'd prefer a solution where no chain is added.
> >I don't know if the 802.1 standard demands that the fdb is updated even
> >if the bridge is not in forwarding state. My opinion is that the
> >PREROUTING chain should be traversed before the fdb is updated. But
> >that's up to the bridge maintainer Stephen Hemminger.
> >  
> >
> Well, the nat table in the prerouting chain isn't really appropriate for 
> filtering incoming frames anyway...is it?

Actually, I don't see any reason why PREROUTING shouldn't be used for
filtering. If I'm not mistaken, the iptables PREROUTING chain isn't
necessarily traversed by each packet, you can see that by looking at the
counters. As each packet traverses the ebtables PREROUTING chain, there
is no reason why you shouldn't filter there.
If you wish, f.e., to drop broadcast traffic then it's best to do it in
PREROUTING, because else you'll need to add rules in FORWARD and INPUT.
Furthermore, the FORWARD chain will be traversed by the to-be-dropped
broadcast packet for each forwarding bridge port.

> >If a new chain is added, then it should be a chain of a new table, like
> >the brouting table (which also has only one chain).
> >  
> >
> That makes much more sense to me. Would the addition of a 'raw' or 
> 'initial' table be suitable, with only one INPUT chain?
> 
> >FYI, your patch isn't completely right. A quick scan shows the brouting
> >chain isn't called at the right time. Note that it is unsafe to do
> >anything with the skb after a NF_HOOK call. I'd be surprised if you
> >don't get an oops when you use the BROUTING chain.
> >  
> >
> Yep, I think I even mentioned something about not being sure how to 
> handle the brouting part properly. The only (simple) way I can think of 
> to handle it would be to make the new table/chain and brouting mutually 
> exclusive.

Just add the call to the brouting chain in the function
br_handle_frame_continue as the first code inside the
BR_STATE_FORWARDING if construct. That way, you introduce a new chain
without breaking anything.

cheers,
Bart




-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click