Re: [RFC] bridge-nf -- map IPv4 hooks onto bridge hooks, vs 2.5.42

["David S. Miller" <davem@redhat.com>]

   From: Bart De Schuymer <bart.de.schuymer@pandora.be>
   Date: Mon, 14 Oct 2002 20:58:53 +0200

   Can the bridge code go fill in a skb->dst and skb->dst->hh? Is this
   considered clean?
   
If it is a properly formed 'dst' entry, it will get cleaned up
at SKB free and there will be no problems.

   > 3) The bridging layer changes need to be approved by Lennert.
   >    But I'd suggest working out #1 and #2 first.
   
   So if I change
   struct nf_conntrack {

You shouldn't be touching nf_conntrack, you should perhaps
instead do something like:

struct nf_ct_info {
	union {
		struct nf_conntrack *master;
		struct nf_bridge_info *brinfo;
	} u;
};
   
But again, you need to get these sorts of extensions and core
changes approved by the netfilter team.

I'm the wrong person to ask about how they would prefer this
stuff be done.

   So if you want this in the kernel you'll have to be forgiving. Or
   present a nice solution, because I and probably Lennert really
   don't see a nice(r) solution.
   
It is my job to show you why a piece of code isn't going
to go in.  It is not my job to help you dream up a better
solution.

Because, frankly I don't care about bridge netfiltering.

I do care about keeping the code as clean as possible so I don't
run into road blocks when trying to rework input/output processing
just because I let some bogon hack into the tree I must continue to
support.

You do care about bridge netfiltering, so you are going to be the
one to find the clean solution that doesn't touch net/ipv4/*.c :-)

This is life in the kernel hacking community :-)

   So, the best solution I can think of is adding a skbuff->brnf pointer to a 
   struct brnf_data. This will get rid of the copy in ip_output.c. Is that 
   enough? This will uglify the ip_tables.c patch however.
   
That could work too, I think you'll need to specify a seperate
destructor in that case, and all this stuff ifdef'd on whether
bridge netfiltering is enabled or not.

Again, talk to the netfilter folks.  They may even have ideas
for you that you haven't dreamt of yet.

Franks a lot,
David S. Miller
davem@redhat.com