From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Hemminger Subject: Re: [PATCH v2] bridge: ebtables: fix reception of frames DNAT-ed to bridge device Date: Tue, 21 Mar 2017 16:32:45 -0700 Message-ID: <20170321163245.34159349@xeon-e3> References: <20170321222845.8373-1-linus.luessing@c0d3.blue> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: netdev@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org, coreteam@netfilter.org, netfilter-devel@vger.kernel.org, Jozsef Kadlecsik , "David S . Miller" , Pablo Neira Ayuso To: Linus =?UTF-8?B?TMO8c3Npbmc=?= Return-path: In-Reply-To: <20170321222845.8373-1-linus.luessing@c0d3.blue> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: bridge-bounces@lists.linux-foundation.org Errors-To: bridge-bounces@lists.linux-foundation.org List-Id: netfilter-devel.vger.kernel.org On Tue, 21 Mar 2017 23:28:45 +0100 Linus L=C3=BCssing wrote: > However, the IP code drops it in the beginning of ip_input.c/ip_rcv() > as the dnat target did not update the skb->pkt_type. If after > dnat'ing the packet is now destined to us then the skb->pkt_type > needs to be updated from PACKET_OTHERHOST to PACKET_HOST, too. Why not fix DNAT netfilter module rather than hacking bridge code here.