From: David Newall <davidn@davidnewall.com>
To: Bart De Schuymer <bdschuym@pandora.be>,
Florian Westphal <fw@strlen.de>,
"David S. Miller" <davem@davemloft.net>
Cc: Stephen Hemminger <stephen@networkplumber.org>,
Netdev <netdev@vger.kernel.org>,
bridge@lists.linux-foundation.org,
netfilter-devel@vger.kernel.org
Subject: Re: [Bridge] Revert 462fb2af9788a82a534f8184abfde31574e1cfa0 (bridge : Sanitize skb before it enters the IP stack)
Date: Thu, 22 May 2014 13:20:05 +0930 [thread overview]
Message-ID: <537D73ED.4010400@davidnewall.com> (raw)
In-Reply-To: <537CF5A2.3080401@pandora.be>
On 22/05/14 04:21, Bart De Schuymer wrote:
> There's no reason why they should overlap in the cb: it's 48 bytes
> big, so big enough to hold both struct br_input_skb_cb and struct
> inet_skb_parm.
No reason, aside from the math, I think. Those 48 bytes appear to be
used for 16 bytes of ip_options plus up to 40 bytes of options data, so
we're using pretend-space; of which we'd need more to squeeze
br_input_skb_cb in at the same time.
I hate opening a second can of worms, but, if I read this right, IPCB is
quite, quite broken.
> As for your other remark: as I've said before, if you don't like
> bridge-netfilter then don't compile it into your kernel.
That's not very helpful. I could say, with just as much merit, that it
should be marked deprecated (so that it's not compiled into distribution
kernels) and you can compile it into yours.
What I dislike is that bridge-netfilter is faulty.
WARNING: multiple messages have this Message-ID (diff)
From: David Newall <davidn@davidnewall.com>
To: Bart De Schuymer <bdschuym@pandora.be>,
Florian Westphal <fw@strlen.de>,
"David S. Miller" <davem@davemloft.net>
Cc: Stephen Hemminger <stephen@networkplumber.org>,
Netdev <netdev@vger.kernel.org>,
netfilter-devel@vger.kernel.org,
bridge@lists.linux-foundation.org
Subject: Re: Revert 462fb2af9788a82a534f8184abfde31574e1cfa0 (bridge : Sanitize skb before it enters the IP stack)
Date: Thu, 22 May 2014 13:20:05 +0930 [thread overview]
Message-ID: <537D73ED.4010400@davidnewall.com> (raw)
In-Reply-To: <537CF5A2.3080401@pandora.be>
On 22/05/14 04:21, Bart De Schuymer wrote:
> There's no reason why they should overlap in the cb: it's 48 bytes
> big, so big enough to hold both struct br_input_skb_cb and struct
> inet_skb_parm.
No reason, aside from the math, I think. Those 48 bytes appear to be
used for 16 bytes of ip_options plus up to 40 bytes of options data, so
we're using pretend-space; of which we'd need more to squeeze
br_input_skb_cb in at the same time.
I hate opening a second can of worms, but, if I read this right, IPCB is
quite, quite broken.
> As for your other remark: as I've said before, if you don't like
> bridge-netfilter then don't compile it into your kernel.
That's not very helpful. I could say, with just as much merit, that it
should be marked deprecated (so that it's not compiled into distribution
kernels) and you can compile it into yours.
What I dislike is that bridge-netfilter is faulty.
next prev parent reply other threads:[~2014-05-22 3:50 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-11 14:41 Bad checksum on bridge with IP options David Newall
2014-05-11 19:42 ` Lukas Tribus
2014-05-12 8:14 ` David Newall
2014-05-12 10:15 ` Lukas Tribus
2014-05-12 10:25 ` David Newall
2014-05-12 10:31 ` Lukas Tribus
2014-05-12 10:48 ` David Newall
2014-05-12 13:23 ` David Newall
2014-05-12 13:51 ` Florian Westphal
2014-05-12 14:19 ` David Newall
2014-05-12 18:54 ` Lukas Tribus
2014-05-12 23:46 ` David Newall
2014-05-14 13:08 ` David Newall
2014-05-16 14:33 ` Revert 462fb2af9788a82a534f8184abfde31574e1cfa0 (bridge : Sanitize skb before it enters the IP stack) David Newall
2014-05-16 15:19 ` Eric Dumazet
2014-05-16 15:23 ` David Newall
2014-05-16 15:24 ` David Newall
2014-05-19 12:58 ` [Bridge] " David Newall
2014-05-19 12:58 ` David Newall
2014-05-19 14:01 ` [Bridge] " Florian Westphal
2014-05-19 14:01 ` Florian Westphal
2014-05-19 14:19 ` [Bridge] " David Newall
2014-05-19 14:19 ` David Newall
2014-05-19 17:09 ` [Bridge] " Florian Westphal
2014-05-19 17:09 ` Florian Westphal
2014-05-19 20:49 ` [Bridge] " Bart De Schuymer
2014-05-19 20:49 ` Bart De Schuymer
2014-05-21 7:49 ` [Bridge] " David Newall
2014-05-21 7:49 ` David Newall
2014-05-21 18:51 ` [Bridge] " Bart De Schuymer
2014-05-21 18:51 ` Bart De Schuymer
2014-05-21 20:18 ` [Bridge] " David Miller
2014-05-21 20:18 ` David Miller
2014-05-22 18:57 ` [Bridge] " Bart De Schuymer
2014-05-22 18:57 ` Bart De Schuymer
2014-05-24 18:00 ` [Bridge] " David Miller
2014-05-24 18:00 ` David Miller
2014-05-24 5:56 ` [Bridge] " David Newall
2014-05-24 5:56 ` David Newall
2014-05-24 17:43 ` [Bridge] " David Miller
2014-05-24 17:43 ` David Miller
2014-05-25 2:32 ` [Bridge] " David Newall
2014-05-25 2:32 ` David Newall
2014-05-25 3:02 ` [Bridge] " David Miller
2014-05-25 3:02 ` David Miller
2014-05-25 6:37 ` [Bridge] " David Newall
2014-05-25 6:37 ` David Newall
2014-05-27 8:55 ` [Bridge] " David Laight
2014-05-27 8:55 ` David Laight
2014-05-29 22:34 ` [Bridge] " David Miller
2014-05-29 22:34 ` David Miller
2014-05-30 9:17 ` [Bridge] " David Newall
2014-05-30 9:17 ` David Newall
2014-05-31 0:46 ` [Bridge] " David Miller
2014-05-31 0:46 ` David Miller
2014-05-31 6:13 ` [Bridge] " David Newall
2014-05-31 6:13 ` David Newall
2014-05-31 6:37 ` [Bridge] " David Miller
2014-05-31 6:37 ` David Miller
2014-05-22 3:50 ` David Newall [this message]
2014-05-22 3:50 ` David Newall
2014-05-22 18:57 ` [Bridge] " Bart De Schuymer
2014-05-22 18:57 ` Bart De Schuymer
2014-05-20 3:57 ` [Bridge] " David Newall
2014-05-20 3:57 ` David Newall
2014-05-20 4:55 ` [Bridge] " Valdis.Kletnieks
2014-05-20 4:55 ` Valdis.Kletnieks
2014-05-20 16:05 ` [Bridge] " Vlad Yasevich
2014-05-20 16:05 ` Vlad Yasevich
2014-05-20 16:05 ` Vlad Yasevich
2014-05-21 8:10 ` [Bridge] " David Newall
2014-05-21 8:10 ` David Newall
2014-05-21 20:14 ` [Bridge] " David Miller
2014-05-21 20:14 ` David Miller
2014-05-21 20:14 ` David Miller
2014-05-22 20:06 ` Bandan Das
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=537D73ED.4010400@davidnewall.com \
--to=davidn@davidnewall.com \
--cc=bdschuym@pandora.be \
--cc=bridge@lists.linux-foundation.org \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=stephen@networkplumber.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.