From: Stephen Hemminger <stephen@networkplumber.org>
To: "Linus Lüssing" <linus.luessing@c0d3.blue>
Cc: netdev@vger.kernel.org, bridge@lists.linux-foundation.org,
linux-kernel@vger.kernel.org, coreteam@netfilter.org,
netfilter-devel@vger.kernel.org,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
"David S . Miller" <davem@davemloft.net>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: Re: [Bridge] [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device
Date: Tue, 21 Mar 2017 16:32:45 -0700 [thread overview]
Message-ID: <20170321163245.34159349@xeon-e3> (raw)
In-Reply-To: <20170321222845.8373-1-linus.luessing@c0d3.blue>
On Tue, 21 Mar 2017 23:28:45 +0100
Linus Lüssing <linus.luessing@c0d3.blue> wrote:
> However, the IP code drops it in the beginning of ip_input.c/ip_rcv()
> as the dnat target did not update the skb->pkt_type. If after
> dnat'ing the packet is now destined to us then the skb->pkt_type
> needs to be updated from PACKET_OTHERHOST to PACKET_HOST, too.
Why not fix DNAT netfilter module rather than hacking bridge code here.
WARNING: multiple messages have this Message-ID (diff)
From: Stephen Hemminger <stephen@networkplumber.org>
To: "Linus Lüssing" <linus.luessing@c0d3.blue>
Cc: netdev@vger.kernel.org, bridge@lists.linux-foundation.org,
linux-kernel@vger.kernel.org, coreteam@netfilter.org,
netfilter-devel@vger.kernel.org,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
"David S . Miller" <davem@davemloft.net>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: Re: [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device
Date: Tue, 21 Mar 2017 16:32:45 -0700 [thread overview]
Message-ID: <20170321163245.34159349@xeon-e3> (raw)
In-Reply-To: <20170321222845.8373-1-linus.luessing@c0d3.blue>
On Tue, 21 Mar 2017 23:28:45 +0100
Linus Lüssing <linus.luessing@c0d3.blue> wrote:
> However, the IP code drops it in the beginning of ip_input.c/ip_rcv()
> as the dnat target did not update the skb->pkt_type. If after
> dnat'ing the packet is now destined to us then the skb->pkt_type
> needs to be updated from PACKET_OTHERHOST to PACKET_HOST, too.
Why not fix DNAT netfilter module rather than hacking bridge code here.
WARNING: multiple messages have this Message-ID (diff)
From: Stephen Hemminger <stephen@networkplumber.org>
To: "Linus Lüssing" <linus.luessing@c0d3.blue>
Cc: netdev@vger.kernel.org, "David S . Miller" <davem@davemloft.net>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
bridge@lists.linux-foundation.org,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device
Date: Tue, 21 Mar 2017 16:32:45 -0700 [thread overview]
Message-ID: <20170321163245.34159349@xeon-e3> (raw)
In-Reply-To: <20170321222845.8373-1-linus.luessing@c0d3.blue>
On Tue, 21 Mar 2017 23:28:45 +0100
Linus Lüssing <linus.luessing@c0d3.blue> wrote:
> However, the IP code drops it in the beginning of ip_input.c/ip_rcv()
> as the dnat target did not update the skb->pkt_type. If after
> dnat'ing the packet is now destined to us then the skb->pkt_type
> needs to be updated from PACKET_OTHERHOST to PACKET_HOST, too.
Why not fix DNAT netfilter module rather than hacking bridge code here.
next prev parent reply other threads:[~2017-03-21 23:32 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-21 22:28 [Bridge] [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device Linus Lüssing
2017-03-21 22:28 ` Linus Lüssing
2017-03-21 22:28 ` Linus Lüssing
2017-03-21 23:32 ` Stephen Hemminger [this message]
2017-03-21 23:32 ` Stephen Hemminger
2017-03-21 23:32 ` Stephen Hemminger
2017-04-17 15:21 ` [Bridge] " Linus Lüssing
2017-04-17 15:21 ` Linus Lüssing
2017-04-17 15:21 ` Linus Lüssing
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170321163245.34159349@xeon-e3 \
--to=stephen@networkplumber.org \
--cc=bridge@lists.linux-foundation.org \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=kadlec@blackhole.kfki.hu \
--cc=linus.luessing@c0d3.blue \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.