From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netdev@vger.kernel.org, bridge@lists.linux-foundation.org,
linux-kernel@vger.kernel.org, coreteam@netfilter.org,
netfilter-devel@vger.kernel.org,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
"David S . Miller" <davem@davemloft.net>
Subject: Re: [Bridge] [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to bridge device
Date: Wed, 15 Mar 2017 11:42:11 +0100 [thread overview]
Message-ID: <20170315104211.GA24409@salvia> (raw)
In-Reply-To: <20170315102608.GB24366@breakpoint.cc>
On Wed, Mar 15, 2017 at 11:26:08AM +0100, Florian Westphal wrote:
> Linus Lüssing <linus.luessing@c0d3.blue> wrote:
> > When trying to redirect bridged frames to the bridge device itself
> > via the ebtables nat-prerouting chain and the dnat target then this
> > currently fails:
> >
> > The ethernet destination of the frame is dnat'ed to the MAC address of
> > the bridge itself just fine and the correctly altered frame can even
> > be captured via a tcpdump on br0 (with or without promisc mode).
> >
> > However, the IP code drops it in the beginning of ip_input.c/ip_rcv()
> > as the dnat target did not update the skb->pkt_type.
>
> Right, thats the reason why ebtables also has ebt_redirect target
> which does this pkt_type fixup.
I'm missing then why redirect is not then just enough for Linus usecase.
WARNING: multiple messages have this Message-ID (diff)
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netdev@vger.kernel.org, bridge@lists.linux-foundation.org,
linux-kernel@vger.kernel.org, coreteam@netfilter.org,
netfilter-devel@vger.kernel.org,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
"David S . Miller" <davem@davemloft.net>
Subject: Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to bridge device
Date: Wed, 15 Mar 2017 11:42:11 +0100 [thread overview]
Message-ID: <20170315104211.GA24409@salvia> (raw)
In-Reply-To: <20170315102608.GB24366@breakpoint.cc>
On Wed, Mar 15, 2017 at 11:26:08AM +0100, Florian Westphal wrote:
> Linus Lüssing <linus.luessing@c0d3.blue> wrote:
> > When trying to redirect bridged frames to the bridge device itself
> > via the ebtables nat-prerouting chain and the dnat target then this
> > currently fails:
> >
> > The ethernet destination of the frame is dnat'ed to the MAC address of
> > the bridge itself just fine and the correctly altered frame can even
> > be captured via a tcpdump on br0 (with or without promisc mode).
> >
> > However, the IP code drops it in the beginning of ip_input.c/ip_rcv()
> > as the dnat target did not update the skb->pkt_type.
>
> Right, thats the reason why ebtables also has ebt_redirect target
> which does this pkt_type fixup.
I'm missing then why redirect is not then just enough for Linus usecase.
WARNING: multiple messages have this Message-ID (diff)
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: "Linus Lüssing" <linus.luessing@c0d3.blue>,
netdev@vger.kernel.org, "David S . Miller" <davem@davemloft.net>,
"Stephen Hemminger" <stephen@networkplumber.org>,
"Jozsef Kadlecsik" <kadlec@blackhole.kfki.hu>,
bridge@lists.linux-foundation.org,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to bridge device
Date: Wed, 15 Mar 2017 11:42:11 +0100 [thread overview]
Message-ID: <20170315104211.GA24409@salvia> (raw)
In-Reply-To: <20170315102608.GB24366@breakpoint.cc>
On Wed, Mar 15, 2017 at 11:26:08AM +0100, Florian Westphal wrote:
> Linus Lüssing <linus.luessing@c0d3.blue> wrote:
> > When trying to redirect bridged frames to the bridge device itself
> > via the ebtables nat-prerouting chain and the dnat target then this
> > currently fails:
> >
> > The ethernet destination of the frame is dnat'ed to the MAC address of
> > the bridge itself just fine and the correctly altered frame can even
> > be captured via a tcpdump on br0 (with or without promisc mode).
> >
> > However, the IP code drops it in the beginning of ip_input.c/ip_rcv()
> > as the dnat target did not update the skb->pkt_type.
>
> Right, thats the reason why ebtables also has ebt_redirect target
> which does this pkt_type fixup.
I'm missing then why redirect is not then just enough for Linus usecase.
next prev parent reply other threads:[~2017-03-15 10:42 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-15 3:18 [Bridge] [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to bridge device Linus Lüssing
2017-03-15 3:18 ` Linus Lüssing
2017-03-15 3:18 ` Linus Lüssing
2017-03-15 10:26 ` [Bridge] " Florian Westphal
2017-03-15 10:26 ` Florian Westphal
2017-03-15 10:42 ` Pablo Neira Ayuso [this message]
2017-03-15 10:42 ` Pablo Neira Ayuso
2017-03-15 10:42 ` Pablo Neira Ayuso
2017-03-15 14:27 ` [Bridge] " Linus Lüssing
2017-03-15 14:27 ` Linus Lüssing
2017-03-15 14:27 ` Linus Lüssing
2017-03-15 18:15 ` [Bridge] " Pablo Neira Ayuso
2017-03-15 18:15 ` Pablo Neira Ayuso
2017-03-15 18:15 ` Pablo Neira Ayuso
2017-03-15 21:16 ` [Bridge] " Linus Lüssing
2017-03-15 21:16 ` Linus Lüssing
2017-03-15 22:06 ` [Bridge] " Pablo Neira Ayuso
2017-03-15 22:06 ` Pablo Neira Ayuso
2017-03-15 22:06 ` Pablo Neira Ayuso
2017-03-17 13:10 ` [Bridge] " Pablo Neira Ayuso
2017-03-17 13:10 ` Pablo Neira Ayuso
2017-03-17 13:10 ` Pablo Neira Ayuso
2017-03-19 16:55 ` [Bridge] " Linus Lüssing
2017-03-19 16:55 ` Linus Lüssing
2017-03-19 16:55 ` Linus Lüssing
2017-03-21 0:09 ` [Bridge] " Linus Lüssing
2017-03-21 0:09 ` Linus Lüssing
2017-03-21 10:11 ` [Bridge] " Pablo Neira Ayuso
2017-03-21 10:11 ` Pablo Neira Ayuso
2017-03-15 10:34 ` [Bridge] " Pablo Neira Ayuso
2017-03-15 10:34 ` Pablo Neira Ayuso
2017-03-15 10:34 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170315104211.GA24409@salvia \
--to=pablo@netfilter.org \
--cc=bridge@lists.linux-foundation.org \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=kadlec@blackhole.kfki.hu \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.