[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LSU.2.00.0906302303350.27569@fbirervta.pbzchgretzou.qr>
Date: Tue, 30 Jun 2009 23:30:42 +0200 (CEST)
From: Jan Engelhardt <jengelh@...ozas.de>
To: Mark Smith <lk-netdev@...netdev.nosense.org>
cc: David Miller <davem@...emloft.net>, herbert@...dor.apana.org.au,
markmc@...hat.com, netdev@...r.kernel.org, kaber@...sh.net,
Netfilter Developer Mailing List
<netfilter-devel@...r.kernel.org>, bdschuym@...dora.be
Subject: Re: [PATCH] bridge: make bridge-nf-call-*tables default
configurable
On Tuesday 2009-06-30 22:57, Mark Smith wrote:
>>>
>>> does conntrack ever make sense for bridging? Perhaps
>>> we should get rid of that completely?
>>
>> It makes sense absolutely. Consider:
>>
>> * packet enters bridge
>> * NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, ...) is called by nr_netfilter.c
>> * (connection tracking entry is set up)
>> * let bridging decision be "local delivery"
>quite a lot by it, due to it's quite strange side effects on traffic.
>e.g. it'll defragment bridged IP packets[...]
Hm not good. Then again, Netfilter does not know where the packet comes
from or where it goes, and Bridge does not know that Conntrack is
(potentially, it even varies) part of PREROUTING.
>I'm not sure if it supposed to work on IP traffic carried within
>bridge PPPoE/PPP, but it does
Bridge unpacks such frames if I've seen the code right :-/
if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
IS_PPPOE_IPV6(skb)) {
nf_bridge_pull_encap_header_rcsum(skb);
return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
}
I, too, wonder, why it would unpack PPP here.
However, there is a sysctl flag called vlan_tagged/pppoe_tagged which
you can se to zero to not pull_encap VLAN/PPP.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists