From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: Content-Type: multipart/alternative; boundary="_abb7a3fe-ae41-4b0d-b6cf-bcaad5e9812d_" From: Fahim Akhter Date: Sat, 8 Nov 2008 16:20:23 +0500 MIME-Version: 1.0 Subject: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: bridge@lists.linux-foundation.org --_abb7a3fe-ae41-4b0d-b6cf-bcaad5e9812d_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Everyone=2C =20 I am currently working on a Ethernet Link Encryptor (so its called). The co= ncept is to have two Subnetworks connected together using two bridges and t= he middle lays the internet connection or another network. The bridge is me= ant for encryption. The ecryption module and ready and working ( independan= tly ) =2C if one bridge is set to crypto the other is supposed to turn on a= utomatically.=20 =20 In crypto mode you only accept packet modified by the other bridge the rest= of the packets ( rest of the LANS/INTERNET) are supposed to be dropped. In= order to acheive that =2C I have to modify all the packets passing through= the bridge so the other bridge is able to recognise it.=20 =20 I was modifying the packets in net/bridge/br_forward.c should_deliver() but= on the other end I only received ARP packets as modified. Than I switched = over to net/bridge/br_input.c br_handle_frame() but encountring the same pr= oblem. And in the kernel log only a few packets appear. ( dmesg =2C I'm pri= nting a message ) =20 I need to Modify all packets passing through the bridge ( in kernel ) . Any= Ideas ?=20 =20 Thanks=2C Fahim Akhter _________________________________________________________________ Discover the new Windows Vista http://search.msn.com/results.aspx?q=3Dwindows+vista&mkt=3Den-US&form=3DQBR= E= --_abb7a3fe-ae41-4b0d-b6cf-bcaad5e9812d_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Everyone=2C
=3B
I am currently working on =3Ba Ethernet Link Encryptor (so its called).= The concept is to have two Subnetworks connected together using two bridge= s and the middle lays the internet connection or another network. The bridg= e is meant for encryption. The ecryption module and ready and working ( ind= ependantly ) =2C if one bridge is set to crypto the other is supposed to tu= rn on automatically.
=3B
In crypto mode you only accept packet modified by the other bridge the rest= of the packets ( rest of the LANS/INTERNET) are supposed to be dropped. In= order to acheive that =2C I have to modify all the packets passing through= the bridge so the other bridge is able to recognise it.
=3B
I was modifying the packets in net/bridge/br_forward.c should_deliver() but= on the other end I only received ARP packets as modified. Than I switched = over to net/bridge/br_input.c br_handle_frame() but encountring the same pr= oblem. And in the kernel log only a few packets appear. ( dmesg =2C I'm pri= nting a message )
=3B
I need to Modify all packets passing through the bridge ( in kernel ) . Any= Ideas ?
=3B
Thanks=2C
Fahim Akhter

Discover the new Windows V= ista Learn more! = --_abb7a3fe-ae41-4b0d-b6cf-bcaad5e9812d_-- From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: Date: Sun, 9 Nov 2008 00:14:21 +0530 From: "Srinivas M.A." In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: Subject: Re: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Fahim Akhter Cc: bridge@lists.linux-foundation.org You could probably use the solution that was given to an earlier question on this list (Bridge with a tweak...). The message is archived at https://lists.linux-foundation.org/pipermail/bridge/2008-October/006074.html . On Sat, Nov 8, 2008 at 4:50 PM, Fahim Akhter wrote: > Hi Everyone, > > I am currently working on a Ethernet Link Encryptor (so its called). The > concept is to have two Subnetworks connected together using two bridges and > the middle lays the internet connection or another network. The bridge is > meant for encryption. The ecryption module and ready and working ( > independantly ) , if one bridge is set to crypto the other is supposed to > turn on automatically. > > In crypto mode you only accept packet modified by the other bridge the rest > of the packets ( rest of the LANS/INTERNET) are supposed to be dropped. In > order to acheive that , I have to modify all the packets passing through the > bridge so the other bridge is able to recognise it. > > I was modifying the packets in net/bridge/br_forward.c should_deliver() but > on the other end I only received ARP packets as modified. Than I switched > over to net/bridge/br_input.c br_handle_frame() but encountring the same > problem. And in the kernel log only a few packets appear. ( dmesg , I'm > printing a message ) > > I need to Modify all packets passing through the bridge ( in kernel ) . Any > Ideas ? > > Thanks, > Fahim Akhter > > ________________________________ > Discover the new Windows Vista Learn more! > _______________________________________________ > Bridge mailing list > Bridge@lists.linux-foundation.org > https://lists.linux-foundation.org/mailman/listinfo/bridge > From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: Content-Type: multipart/alternative; boundary="_7daa7573-978c-4a39-a3ce-91b0874230bc_" From: Fahim Akhter Date: Mon, 10 Nov 2008 11:27:49 +0500 In-Reply-To: References: MIME-Version: 1.0 Subject: Re: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: srinivas.aji@gmail.com Cc: bridge@lists.linux-foundation.org --_7daa7573-978c-4a39-a3ce-91b0874230bc_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable The Link https://lists.linux-foundation.org/pipermail/bridge/2008-October/0= 06074.html =2C is about capturing packets and sending to user space. Speed = is important in my current scenario. Is there anyway I can do everything in= kernel specially by hacking or tweaking the already kernel space. Instead = of socket programming and capturing packets at ethernet?> Date: Sun=2C 9 No= v 2008 00:14:21 +0530> From: srinivas.aji@gmail.com> To: akhter.fahim@hotma= il.com> Subject: Re: [Bridge] Modifying All Packets passing through the bri= dge!> CC: bridge@lists.linux-foundation.org> > You could probably use the s= olution that was given to an earlier> question on this list (Bridge with a = tweak...). The message is> archived at https://lists.linux-foundation.org/p= ipermail/bridge/2008-October/006074.html> .> > On Sat=2C Nov 8=2C 2008 at 4= :50 PM=2C Fahim Akhter wrote:> > Hi Everyone=2C>= >> > I am currently working on a Ethernet Link Encryptor (so its called). = The> > concept is to have two Subnetworks connected together using two brid= ges and> > the middle lays the internet connection or another network. The = bridge is> > meant for encryption. The ecryption module and ready and worki= ng (> > independantly ) =2C if one bridge is set to crypto the other is sup= posed to> > turn on automatically.> >> > In crypto mode you only accept pac= ket modified by the other bridge the rest> > of the packets ( rest of the L= ANS/INTERNET) are supposed to be dropped. In> > order to acheive that =2C I= have to modify all the packets passing through the> > bridge so the other = bridge is able to recognise it.> >> > I was modifying the packets in net/br= idge/br_forward.c should_deliver() but> > on the other end I only received = ARP packets as modified. Than I switched> > over to net/bridge/br_input.c b= r_handle_frame() but encountring the same> > problem. And in the kernel log= only a few packets appear. ( dmesg =2C I'm> > printing a message )> >> > I= need to Modify all packets passing through the bridge ( in kernel ) . Any>= > Ideas ?> >> > Thanks=2C> > Fahim Akhter> >> > __________________________= ______> > Discover the new Windows Vista Learn more!> > ___________________= ____________________________> > Bridge mailing list> > Bridge@lists.linux-f= oundation.org> > https://lists.linux-foundation.org/mailman/listinfo/bridge= > > _________________________________________________________________ Connect to the next generation of MSN Messenger=A0 http://imagine-msn.com/messenger/launch80/default.aspx?locale=3Den-us&sourc= e=3Dwlmailtagline= --_7daa7573-978c-4a39-a3ce-91b0874230bc_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable The Link https://lists.linux-foundation.org/pipermail/bridge/= 2008-October/006074.html =2C is about capturing packets and sending to = user space. Speed is important in my current scenario. Is there anyway I ca= n do everything in kernel specially by hacking or tweaking the already kern= el space. Instead of socket programming and capturing packets at ethernet?<= BR>
>=3B Date: Sun=2C 9 Nov 2008 00:14:21 +0530
>=3B From: sriniv= as.aji@gmail.com
>=3B To: akhter.fahim@hotmail.com
>=3B Subject: = Re: [Bridge] Modifying All Packets passing through the bridge!
>=3B CC= : bridge@lists.linux-foundation.org
>=3B
>=3B You could probably= use the solution that was given to an earlier
>=3B question on this l= ist (Bridge with a tweak...). The message is
>=3B archived at https://= lists.linux-foundation.org/pipermail/bridge/2008-October/006074.html
>= =3B .
>=3B
>=3B On Sat=2C Nov 8=2C 2008 at 4:50 PM=2C Fahim Akht= er <=3Bakhter.fahim@hotmail.com>=3B wrote:
>=3B >=3B Hi Everyone= =2C
>=3B >=3B
>=3B >=3B I am currently working on a Ethernet = Link Encryptor (so its called). The
>=3B >=3B concept is to have two= Subnetworks connected together using two bridges and
>=3B >=3B the = middle lays the internet connection or another network. The bridge is
&g= t=3B >=3B meant for encryption. The ecryption module and ready and workin= g (
>=3B >=3B independantly ) =2C if one bridge is set to crypto the= other is supposed to
>=3B >=3B turn on automatically.
>=3B >= =3B
>=3B >=3B In crypto mode you only accept packet modified by the = other bridge the rest
>=3B >=3B of the packets ( rest of the LANS/IN= TERNET) are supposed to be dropped. In
>=3B >=3B order to acheive th= at =2C I have to modify all the packets passing through the
>=3B >= =3B bridge so the other bridge is able to recognise it.
>=3B >=3B>=3B >=3B I was modifying the packets in net/bridge/br_forward.c shoul= d_deliver() but
>=3B >=3B on the other end I only received ARP packe= ts as modified. Than I switched
>=3B >=3B over to net/bridge/br_inpu= t.c br_handle_frame() but encountring the same
>=3B >=3B problem. An= d in the kernel log only a few packets appear. ( dmesg =2C I'm
>=3B &g= t=3B printing a message )
>=3B >=3B
>=3B >=3B I need to Modif= y all packets passing through the bridge ( in kernel ) . Any
>=3B >= =3B Ideas ?
>=3B >=3B
>=3B >=3B Thanks=2C
>=3B >=3B Fa= him Akhter
>=3B >=3B
>=3B >=3B ______________________________= __
>=3B >=3B Discover the new Windows Vista Learn more!
>=3B &g= t=3B _______________________________________________
>=3B >=3B Bridg= e mailing list
>=3B >=3B Bridge@lists.linux-foundation.org
>=3B= >=3B https://lists.linux-foundation.org/mailman/listinfo/bridge
>= =3B >=3B

Connect to the next generation of MSN Messenger= =A0 Get it now! = --_7daa7573-978c-4a39-a3ce-91b0874230bc_-- From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: Date: Mon, 10 Nov 2008 15:58:05 +0530 From: "Srinivas M.A." In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References:

Subject: Re: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Fahim Akhter Cc: bridge@lists.linux-foundation.org On Mon, Nov 10, 2008 at 11:57 AM, Fahim Akhter wrote: > The Link > https://lists.linux-foundation.org/pipermail/bridge/2008-October/006074.html > , is about capturing packets and sending to user space. Speed is important > in my current scenario. Is there anyway I can do everything in kernel > specially by hacking or tweaking the already kernel space. Instead of socket > programming and capturing packets at ethernet? That message also talks about the case where userspace will not give you enough performance. The thing to do then would be to write a network driver which sits on top of a real network device and processes the packets before passing it on in either direction. Look for the vlan and bonding drivers for examples. Or maybe you could use the netfilter hooks in bridging, if your use of this encrypted link is restricted to being between bridges. From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: Content-Type: multipart/alternative; boundary="_de42c297-967b-4396-a8de-fc19be9ef9f0_" From: Fahim Akhter Date: Mon, 10 Nov 2008 17:02:34 +0500 In-Reply-To: References:

MIME-Version: 1.0 Subject: Re: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: srinivas.aji@gmail.com Cc: bridge@lists.linux-foundation.org --_de42c297-967b-4396-a8de-fc19be9ef9f0_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Thanks a lot for the quick replies.=20 =20 I tried doing it with Bridging Hooks. Rather in the Bridge. I wrote a scrip= t with was used to modify the packets if not already modified which was pla= ced in /net/bridge/br_forward.c br_forward() and the packets were listened= and encrypted in /net/bridge/br_forward.c should_deliver(). The enmcryptio= n keys and status were travelling fine. But upon analyzing the packet. On t= he receiving end using a Windows Based packet Analyzer. I got to know that = only ARP broadcast packets were being modified. =20 I found an old code which used kernel 2.4 used for encryption. The encrypti= on was done in /net/bridge/br_input.c br_handle_frame(). I did all the usu= al stuff there but still now effect its still only modifying the ARP packet= s. =20 The ethernets are running in promiscous mode=2C the settings are default an= d the bridge works fine. Except for the fact it doesn't encrypt.=20 =20 It's taken me a while to get to this point. This being my first linux proje= ct. Hope I get a solution which takes me forward from this instead of start= ing from the start...> Date: Mon=2C 10 Nov 2008 15:58:05 +0530> From: srini= vas.aji@gmail.com> To: akhter.fahim@hotmail.com> Subject: Re: [Bridge] Modi= fying All Packets passing through the bridge!> CC: bridge@lists.linux-found= ation.org> > On Mon=2C Nov 10=2C 2008 at 11:57 AM=2C Fahim Akhter wrote:> > The Link> > https://lists.linux-foundation.org/= pipermail/bridge/2008-October/006074.html> > =2C is about capturing packets= and sending to user space. Speed is important> > in my current scenario. I= s there anyway I can do everything in kernel> > specially by hacking or twe= aking the already kernel space. Instead of socket> > programming and captur= ing packets at ethernet?> > That message also talks about the case where us= erspace will not give> you enough performance. The thing to do then would b= e to write a> network driver which sits on top of a real network device and= > processes the packets before passing it on in either direction. Look> for= the vlan and bonding drivers for examples. Or maybe you could use> the net= filter hooks in bridging=2C if your use of this encrypted link is> restrict= ed to being between bridges. _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=3D7+wonders+world&mkt=3Den-US&form=3DQ= BRE= --_de42c297-967b-4396-a8de-fc19be9ef9f0_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Thanks a lot for the quick replies.
=3B
I tried doing it with Bridging Hooks. Rather in the Bridge. I wrote a scrip= t with was used to modify the packets if not already modified which was pla= ced in /net/bridge/br_forward.c =3B br_forward() and the packets were l= istened and encrypted in /net/bridge/br_forward.c should_deliver(). The enm= cryption keys and status were travelling fine. But upon analyzing the packe= t. On the receiving end using a Windows Based packet Analyzer. I got to kno= w that only ARP broadcast packets were being modified.
=3B
I found an old code which used kernel 2.4 used for encryption. The encrypti= on was done in /net/bridge/br_input.c br_handle_frame(). =3B I did all = the usual stuff there but still now effect its still only modifying the ARP= packets.
=3B
The ethernets are running in promiscous mode=2C the settings are default an= d the bridge works fine. Except for the fact it doesn't encrypt.
=3B
It's taken me a while to get =3Bto this point. This being my first linu= x project. Hope I get a solution which takes me forward from this instead o= f starting from the start...

>=3B Date: Mon=2C 10 Nov 2008 15:58:0= 5 +0530
>=3B From: srinivas.aji@gmail.com
>=3B To: akhter.fahim@h= otmail.com
>=3B Subject: Re: [Bridge] Modifying All Packets passing th= rough the bridge!
>=3B CC: bridge@lists.linux-foundation.org
>=3B=
>=3B On Mon=2C Nov 10=2C 2008 at 11:57 AM=2C Fahim Akhter <=3Bakht= er.fahim@hotmail.com>=3B wrote:
>=3B >=3B The Link
>=3B >= =3B https://lists.linux-foundation.org/pipermail/bridge/2008-October/006074= .html
>=3B >=3B =2C is about capturing packets and sending to user s= pace. Speed is important
>=3B >=3B in my current scenario. Is there = anyway I can do everything in kernel
>=3B >=3B specially by hacking = or tweaking the already kernel space. Instead of socket
>=3B >=3B pr= ogramming and capturing packets at ethernet?
>=3B
>=3B That mess= age also talks about the case where userspace will not give
>=3B you e= nough performance. The thing to do then would be to write a
>=3B netwo= rk driver which sits on top of a real network device and
>=3B processe= s the packets before passing it on in either direction. Look
>=3B for = the vlan and bonding drivers for examples. Or maybe you could use
>=3B= the netfilter hooks in bridging=2C if your use of this encrypted link is>=3B restricted to being between bridges.

Explore th= e seven wonders of the world Learn more! = --_de42c297-967b-4396-a8de-fc19be9ef9f0_-- From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Mon, 10 Nov 2008 08:35:01 -0800 From: Stephen Hemminger Message-ID: <20081110083501.55aa10fd@extreme> In-Reply-To: References:

Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: Re: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Fahim Akhter Cc: bridge@lists.linux-foundation.org On Mon, 10 Nov 2008 17:02:34 +0500 Fahim Akhter wrote: > > Thanks a lot for the quick replies. > > I tried doing it with Bridging Hooks. Rather in the Bridge. I wrote a script with was used to modify the packets if not already modified which was placed in /net/bridge/br_forward.c br_forward() and the packets were listened and encrypted in /net/bridge/br_forward.c should_deliver(). The enmcryption keys and status were travelling fine. But upon analyzing the packet. On the receiving end using a Windows Based packet Analyzer. I got to know that only ARP broadcast packets were being modified. > > I found an old code which used kernel 2.4 used for encryption. The encryption was done in /net/bridge/br_input.c br_handle_frame(). I did all the usual stuff there but still now effect its still only modifying the ARP packets. > > The ethernets are running in promiscous mode, the settings are default and the bridge works fine. Except for the fact it doesn't encrypt. > > It's taken me a while to get to this point. This being my first linux project. Hope I get a solution which takes me forward from this instead of starting from the start...> Date: Mon, 10 Nov 2008 15:58:05 +0530> From: srinivas.aji@gmail.com> To: akhter.fahim@hotmail.com> Subject: Re: [Bridge] Modifying All Packets passing through the bridge!> CC: bridge@lists.linux-foundation.org> > On Mon, Nov 10, 2008 at 11:57 AM, Fahim Akhter wrote:> > The Link> > https://lists.linux-foundation.org/pipermail/bridge/2008-October/006074.html> > , is about capturing packets and sending to user space. Speed is important> > in my current scenario. Is there anyway I can do everything in kernel> > specially by hacking or tweaking the already kernel space. Instead of socket> > programming and capturing packets at ethernet?> > That message also talks about the case where userspace will not give> you enough performance. The thing to do then would be to write a> network d river which sits on top of a real network device and> processes the packets before passing it on in either direction. Look> for the vlan and bonding drivers for examples. Or maybe you could use> the netfilter hooks in bridging, if your use of this encrypted link is> restricted to being between bridges. > _________________________________________________________________ > Explore the seven wonders of the world > http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE Use ebtables, and write a netfilter module to do what you want. There is no reason to mess wit the bridging infrastructure to do this. Netfilter is the way to do all the kinds of analysis, filtering, and packet mangling you might want. From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: Content-Type: multipart/alternative; boundary="_ce0a7da0-be3b-4125-b5f5-b103123d4b1d_" From: Fahim Akhter Date: Tue, 11 Nov 2008 10:19:53 +0500 In-Reply-To: <20081110083501.55aa10fd@extreme> References:

= --_ce0a7da0-be3b-4125-b5f5-b103123d4b1d_-- From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: Content-Type: multipart/alternative; boundary="_5f4e0a46-a434-4c6e-8171-68582048111f_" From: Fahim Akhter Date: Tue, 11 Nov 2008 12:16:34 +0500 In-Reply-To: <20081110083501.55aa10fd@extreme> References:

<20081110083501.55aa10fd@extreme> MIME-Version: 1.0 Subject: Re: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: shemminger@vyatta.com Cc: bridge@lists.linux-foundation.org --_5f4e0a46-a434-4c6e-8171-68582048111f_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable P.S according to the little knowledge I have netfilters decide the fate of = the packet by looking at the header not the data=2C but I need the data to = decide what to do with the packet.> Date: Mon=2C 10 Nov 2008 08:35:01 -0800= > From: shemminger@vyatta.com> To: akhter.fahim@hotmail.com> CC: srinivas.a= ji@gmail.com=3B bridge@lists.linux-foundation.org> Subject: Re: [Bridge] Mo= difying All Packets passing through the bridge!> > On Mon=2C 10 Nov 2008 17= :02:34 +0500> Fahim Akhter wrote:> > > > > Thank= s a lot for the quick replies. > > > > I tried doing it with Bridging Hooks= . Rather in the Bridge. I wrote a script with was used to modify the packet= s if not already modified which was placed in /net/bridge/br_forward.c br_f= orward() and the packets were listened and encrypted in /net/bridge/br_forw= ard.c should_deliver(). The enmcryption keys and status were travelling fin= e. But upon analyzing the packet. On the receiving end using a Windows Base= d packet Analyzer. I got to know that only ARP broadcast packets were being= modified.> > > > I found an old code which used kernel 2.4 used for encryp= tion. The encryption was done in /net/bridge/br_input.c br_handle_frame(). = I did all the usual stuff there but still now effect its still only modifyi= ng the ARP packets.> > > > The ethernets are running in promiscous mode=2C = the settings are default and the bridge works fine. Except for the fact it = doesn't encrypt. > > > > It's taken me a while to get to this point. This b= eing my first linux project. Hope I get a solution which takes me forward f= rom this instead of starting from the start...> Date: Mon=2C 10 Nov 2008 15= :58:05 +0530> From: srinivas.aji@gmail.com> To: akhter.fahim@hotmail.com> S= ubject: Re: [Bridge] Modifying All Packets passing through the bridge!> CC:= bridge@lists.linux-foundation.org> > On Mon=2C Nov 10=2C 2008 at 11:57 AM= =2C Fahim Akhter wrote:> > The Link> > https://l= ists.linux-foundation.org/pipermail/bridge/2008-October/006074.html> > =2C = is about capturing packets and sending to user space. Speed is important> >= in my current scenario. Is there anyway I can do everything in kernel> > s= pecially by hacking or tweaking the already kernel space. Instead of socket= > > programming and capturing packets at ethernet?> > That message also tal= ks about the case where userspace will not give> you enough performance. Th= e thing to do then would be to write a> network d> river which sits on top = of a real network device and> processes the packets before passing it on in= either direction. Look> for the vlan and bonding drivers for examples. Or = maybe you could use> the netfilter hooks in bridging=2C if your use of this= encrypted link is> restricted to being between bridges.> > _______________= __________________________________________________> > Explore the seven won= ders of the world> > http://search.msn.com/results.aspx?q=3D7+wonders+world= &mkt=3Den-US&form=3DQBRE> > > Use ebtables=2C and write a netfilter module = to do what you want.> There is no reason to mess wit the bridging infrastru= cture to do this.> > Netfilter is the way to do all the kinds of analysis= =2C filtering=2C and packet> mangling you might want. _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=3D7+wonders+world&mkt=3Den-US&form=3DQ= BRE= --_5f4e0a46-a434-4c6e-8171-68582048111f_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable P.S according to the little knowledge I have netfilters decide the fate of = the packet by looking at the header not the data=2C but I need the data to = decide what to do with the packet.

>=3B Date: Mon=2C 10 Nov 2008 0= 8:35:01 -0800
>=3B From: shemminger@vyatta.com
>=3B To: akhter.fa= him@hotmail.com
>=3B CC: srinivas.aji@gmail.com=3B bridge@lists.linux-= foundation.org
>=3B Subject: Re: [Bridge] Modifying All Packets passin= g through the bridge!
>=3B
>=3B On Mon=2C 10 Nov 2008 17:02:34 += 0500
>=3B Fahim Akhter <=3Bakhter.fahim@hotmail.com>=3B wrote:
= >=3B
>=3B >=3B
>=3B >=3B Thanks a lot for the quick repli= es.
>=3B >=3B
>=3B >=3B I tried doing it with Bridging Hook= s. Rather in the Bridge. I wrote a script with was used to modify the packe= ts if not already modified which was placed in /net/bridge/br_forward.c br_= forward() and the packets were listened and encrypted in /net/bridge/br_for= ward.c should_deliver(). The enmcryption keys and status were travelling fi= ne. But upon analyzing the packet. On the receiving end using a Windows Bas= ed packet Analyzer. I got to know that only ARP broadcast packets were bein= g modified.
>=3B >=3B
>=3B >=3B I found an old code which us= ed kernel 2.4 used for encryption. The encryption was done in /net/bridge/b= r_input.c br_handle_frame(). I did all the usual stuff there but still now = effect its still only modifying the ARP packets.
>=3B >=3B
>= =3B >=3B The ethernets are running in promiscous mode=2C the settings are= default and the bridge works fine. Except for the fact it doesn't encrypt.=
>=3B >=3B
>=3B >=3B It's taken me a while to get to this p= oint. This being my first linux project. Hope I get a solution which takes = me forward from this instead of starting from the start...>=3B Date: Mon= =2C 10 Nov 2008 15:58:05 +0530>=3B From: srinivas.aji@gmail.com>=3B To:= akhter.fahim@hotmail.com>=3B Subject: Re: [Bridge] Modifying All Packets= passing through the bridge!>=3B CC: bridge@lists.linux-foundation.org>= =3B >=3B On Mon=2C Nov 10=2C 2008 at 11:57 AM=2C Fahim Akhter <=3Bakhte= r.fahim@hotmail.com>=3B wrote:>=3B >=3B The Link>=3B >=3B https:/= /lists.linux-foundation.org/pipermail/bridge/2008-October/006074.html>=3B= >=3B =2C is about capturing packets and sending to user space. Speed is = important>=3B >=3B in my current scenario. Is there anyway I can do eve= rything in kernel>=3B >=3B specially by hacking or tweaking the already= kernel space. Instead of socket>=3B >=3B programming and capturing pac= kets at ethernet?>=3B >=3B That message also talks about the case where= userspace will not give>=3B you enough performance. The thing to do then= would be to write a>=3B network d
>=3B river which sits on top of a= real network device and>=3B processes the packets before passing it on i= n either direction. Look>=3B for the vlan and bonding drivers for example= s. Or maybe you could use>=3B the netfilter hooks in bridging=2C if your = use of this encrypted link is>=3B restricted to being between bridges.>=3B >=3B ____________________________________________________________= _____
>=3B >=3B Explore the seven wonders of the world
>=3B >= =3B http://search.msn.com/results.aspx?q=3D7+wonders+world&=3Bmkt=3Den-U= S&=3Bform=3DQBRE
>=3B
>=3B
>=3B Use ebtables=2C and wri= te a netfilter module to do what you want.
>=3B There is no reason to = mess wit the bridging infrastructure to do this.
>=3B
>=3B Netfi= lter is the way to do all the kinds of analysis=2C filtering=2C and packet<= BR>>=3B mangling you might want.

Explore the seven wonders= of the world Learn more! = --_5f4e0a46-a434-4c6e-8171-68582048111f_-- From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Tue, 11 Nov 2008 09:11:05 -0800 From: Stephen Hemminger Message-ID: <20081111091105.2de861bb@extreme> In-Reply-To: References:

<20081110083501.55aa10fd@extreme> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: Re: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Fahim Akhter Cc: bridge@lists.linux-foundation.org On Tue, 11 Nov 2008 12:16:34 +0500 Fahim Akhter wrote: > > P.S according to the little knowledge I have netfilters decide the fate of the packet by looking at the header not the data, but I need the data to decide what to do with the packet. Netfilter modules can see the whole packet From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: Content-Type: multipart/alternative; boundary="_b6ba0860-2f3b-4216-bd0e-f41dfbcd32e3_" From: Fahim Akhter Date: Thu, 13 Nov 2008 11:12:25 +0500 In-Reply-To: <20081111091105.2de861bb@extreme> References:

<20081110083501.55aa10fd@extreme> <20081111091105.2de861bb@extreme> MIME-Version: 1.0 Subject: Re: [Bridge] Modifying All Packets passing through the bridge! List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: shemminger@vyatta.com Cc: bridge@lists.linux-foundation.org --_b6ba0860-2f3b-4216-bd0e-f41dfbcd32e3_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Thanks a lot for your kind and generous help. So the final point is I use n= etfilters for it :) =20 When I was doing the encryption through the bridge=2C I used to set the sta= tus (crypto/plain) master/slave through bridge control. But since I won't h= ave the back end now instead netfilters. Is there any way to keep the statu= s updated ? =20 thanks again!> Date: Tue=2C 11 Nov 2008 09:11:05 -0800> From: shemminger@vy= atta.com> To: akhter.fahim@hotmail.com> CC: srinivas.aji@gmail.com=3B bridg= e@lists.linux-foundation.org> Subject: Re: [Bridge] Modifying All Packets p= assing through the bridge!> > On Tue=2C 11 Nov 2008 12:16:34 +0500> Fahim A= khter wrote:> > > > > P.S according to the littl= e knowledge I have netfilters decide the fate of the packet by looking at t= he header not the data=2C but I need the data to decide what to do with the= packet.> > Netfilter modules can see the whole packet=20 _________________________________________________________________ Connect to the next generation of MSN Messenger=A0 http://imagine-msn.com/messenger/launch80/default.aspx?locale=3Den-us&sourc= e=3Dwlmailtagline= --_b6ba0860-2f3b-4216-bd0e-f41dfbcd32e3_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Thanks a lot for your kind and generous help. So the final point is I use n= etfilters for it :)
=3B
When I was doing the encryption through the bridge=2C I used to set the sta= tus (crypto/plain) master/slave through bridge control. But since I won't h= ave the back end now instead netfilters. Is there any way to keep the statu= s updated ?
=3B
thanks again!

>=3B Date: Tue=2C 11 Nov 2008 09:11:05 -0800
>= =3B From: shemminger@vyatta.com
>=3B To: akhter.fahim@hotmail.com
&= gt=3B CC: srinivas.aji@gmail.com=3B bridge@lists.linux-foundation.org
&g= t=3B Subject: Re: [Bridge] Modifying All Packets passing through the bridge= !
>=3B
>=3B On Tue=2C 11 Nov 2008 12:16:34 +0500
>=3B Fahim= Akhter <=3Bakhter.fahim@hotmail.com>=3B wrote:
>=3B
>=3B &g= t=3B
>=3B >=3B P.S according to the little knowledge I have netfilt= ers decide the fate of the packet by looking at the header not the data=2C = but I need the data to decide what to do with the packet.
>=3B
>= =3B Netfilter modules can see the whole packet

Connect = to the next generation of MSN Messenger=A0 Get it now! = --_b6ba0860-2f3b-4216-bd0e-f41dfbcd32e3_--