From: Nicolas Cavallari <Nicolas.Cavallari@lri.fr>
To: netfilter@vger.kernel.org
Subject: Bogus MAC in netfilter-queue for IF_MULTICAST_LOOPed packets.
Date: Wed, 01 Jun 2011 11:36:30 +0200 [thread overview]
Message-ID: <4DE6081E.7060404@lri.fr> (raw)
Multicast packets sent from local applications that use the
IF_MULTICAST_LOOP are to be sent to the specified interface as well as
being delivered to all local applications on the host listening for the
right multicast address. But i found that the looped packets for local
applications are being filtered in PREROUTING.
I want to accept them to not break local applications that depends on
it, but there isn't an easy way to accept them.
but in PREROUTING i also have a NFQUEUE target for incoming multicast
packets to do MAC-based accounting/filtering/marking, and these looped
packets are delivered with bogus source MAC addresses.
I found out that this bogus MAC address is taken from the IP header. For
example, the given looped packet :
45 00 00 3d 00 00 40 00 ff 11 ce 05 0a 00 01 02 e0 00 00 fb ....
yield this sMAC : 40:00:ff:11:ce:05, as if the IP header was treated as
a MAC header.
The LOG target display these packets as having no MAC address (Indeed,
the multicast loop code strips the MAC header). By looking at the code,
nf_queue.c and ipk_LOG.c access the mac address in different ways, and i
don't know which one should be used and what should be fixed.
next reply other threads:[~2011-06-01 9:36 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-06-01 9:36 Nicolas Cavallari [this message]
2011-06-01 10:31 ` Bogus MAC in netfilter-queue for IF_MULTICAST_LOOPed packets Jan Engelhardt
2011-06-01 12:05 ` Nicolas Cavallari
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DE6081E.7060404@lri.fr \
--to=nicolas.cavallari@lri.fr \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.