Re: [PATCH] support --physdev-out for routed packets

[Patrick McHardy <kaber@trash.net>]

Philip Craig wrote:
> My most common use of bridging is a transparent firewall between
> the LAN and the WAN.  This requires the ability to filter based on
> the outgoing port, which the current physdev match supports.
> 
...
> 
> So here is an ugly, inefficient, flawed, and barely tested patch
> which lets me do this.  I have no expectation of this being suitable
> for mainline kernels, but maybe someone else is interested in it or
> wants to comment on the approach.
> 
> The patch digs into the bridge internals too much, causes an extra
> bridge fdb lookup, ignores some const attributes, and probably has
> broken locking.  And if there are no ARP or bridge fdb entries, then
> it doesn't match any ports.


Its probably also racy wrt. fdb changes. The thing I still don't get
is .. if you combine a bunch of devices in a bridge, why would you
care which port a packet will leave through? If you already know
behind which port something is reachable, why use a bridge? And if
you don't know I suppose you have nothing to filter by.