Re: RFC: bridge netfilter vlan device name resolution

[Bart De Schuymer <bdschuym@pandora.be>]

Op 2/04/2012 11:25, Florian Westphal schreef:
> Bart De Schuymer<bdschuym@pandora.be>  wrote:
>> I don't like approach #2: it will break existing firewall 
>> configurations and I really don't see a reason why we would change 
>> the network device to a non-bridge device (br0.1 isn't a bridge). 
>> Approach #1 can be achieved without code changes with the nfmark 
>> field as shown below. You can filter on the vlan id in iptables by 
>> using the nfmark field intelligently, see e.g. 
>> http://ebtables.sourceforge.net/examples/basic.html#ex_network_separation 
>
> However, the REDIRECT target won't work with vlans on the bridge,
> because skb->dev points to the bridge instead of the vlan, and thus
> the REDIRECT target fails to get the ip address.

Can't you use the DNAT target instead? If you have multiple vlan devices 
on top with multiple IP addresses, you can use the nfmark value to 
determine the destination IP address.
> Would at least the PRE_ROUTING part of my patch be acceptable to make
> REDIRECT work?

No, for the same reasons as stated before... What would be acceptable is 
an extension that allows to specify which input device to give to 
iptables. Perhaps for your use case, another flag in 
|/proc/sys/net/bridge/ |that allows turning this feature on (off by 
default) would be nice. The behaviour should then be like your original 
idea and not restricted to only the PREROUTING case described above. A 
name for the flag that comes to mind is |bridge-nf-pass-vlan-input-device.|

Best regards,
Bart

-- 
Bart De Schuymer
www.artinalgorithms.be