Re: RFC: Disable defered bridge hooks by default

[Philip Craig <philipc@snapgear.com>]

Patrick McHardy wrote:
> On Wed, 12 Jul 2006, Philip Craig wrote:
>
>> Patrick McHardy wrote:
>> Would it be possible to call the bridging code from the iptables
>> forward/output hooks, store the result somewhere, and then when the
>> packet is passed to the bridge device, just use the stored result?
>> So fix the problem by calling bridging early, instead of deferring
>> iptables?  I'm not sure if this could handle packets that need to
>> be sent out multiple ports.
>
> No, it couldn't. Its questionable behaviour to do this anyway, think
> about something you REJECT without looking at the output port - you
> will reject once for each output port. The entire idea of using
> iptables from the bridge code seems flawed to me. Conntrack might
> also get very confused under certain cicurstances.

These are also problems for purely bridged packets.  br_flood calls
__br_forward for every port, which calls the bridge forward hook, and
that passes the packet on to the ipv4 forward hook.  Should this be
changed so that the ipv4 forward hook is called earlier, and filtering
on output port is never possible?