Re: [PATCH][BRIDGE-NETFILTER] fix REJECT for bridged traffic

[Bart De Schuymer <bdschuym@pandora.be>]

Patrick McHardy schreef:
> Bart De Schuymer wrote:
>   
>> Patrick McHardy schreef:
>>     
>>> Also proper ETH_* values please. But I'm wondering, we already save
>>> the entire header in br_nf_post_routing(). Can't that be done earlier
>>> so the upper layers don't have to care about this stuff and can simply
>>> attach the original nf_bridge reference?
>>>
>>>   
>>>       
>> If you don't save the correct MAC address for the newly created skbuff
>> in ipt_REJECT, there is no way to get it back later. Furthermore, if you
>> save the header too early, MAC SNAT and DNAT might have changed the
>> header and you have to resave the header anyway.
>>     
>
> Yes, we need to save it at some point. My idea was that we might be able
> to save it in PREROUTING instead of POSTROUTING and only do
>
> nskb->nf_bridge = nf_bridge_get(oskb->nf_bridge)
>
> in ipt_REJECT and probably also the ICMP code. MAC NAT could be handled
> by updating the bridge info simultaneously.
>
>   
Patrick,

The code creates a new skbuf and the correct source MAC address is lost 
if you don't attach it to the skbuf at that time. How will you know in 
PREROUTING what SMAC to use if you didn't save it when you created the 
skbuf?

cheers,
Bart

-- 
Bart De Schuymer
www.artinalgorithms.be