Re: indev_name in bridge+iptables?

[Harald Welte <laforge@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1741 bytes --]

On Sat, Jul 12, 2003 at 08:27:59AM -0700, Scott MacKay wrote:
> Hi, I had the exact same thing.  The physical name is
> not passed up in the message, sucks huh?
> 
> What I resorted to was to alter the kernel code for
> the QUEUE messages.  The low level structure has the
> physical device names in it, but are not passed up.  I
> altered it so if there was a physical device name for
> in & out, it copied those values over the existing
> indev and outdev names (since 'br0' is pretty
> useless).  There is only 1 file to change, but can't
> remember it off the top of my head.  The 'real' method
> would be to alter the _msg structure to include the
> physdev names in it, but I was lazy :P

The reason for this dilemma is historical:

- ip_queue was in the kernel first (since pre 2.4.0)
- support for bridging firewalls was added later
- real support for physdev matching in iptables is only available
  for kernel 2.5.x
- changing the ipq_msg structure would render all previous versions of
  libipq (and existing ip_queue using applications) incompatible with
  new kernels

Combined with the fact that bridging firewalls still seem very rare,
we'd rather stick with compatibility instead of adding that feature...

... however, a patch is always welcome and we'd put it into
patch-o-matic 'experimental' or something.

> -Scott

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]