From: stoffl4ever <stoffl4ever@gmail.com>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter@vger.kernel.org
Subject: Re: nft icmpv6 mld-listener-query rule not honored?
Date: Mon, 01 Dec 2014 16:53:20 +0100 [thread overview]
Message-ID: <547C8EF0.4070200@gmail.com> (raw)
In-Reply-To: <20141201125940.GA11047@salvia>
On 01.12.2014 13:59, Pablo Neira Ayuso wrote:
> On Tue, Nov 25, 2014 at 02:27:15PM +0100, stoffl4ever wrote:
>> SysInfo:
>> kernel: 3.17.4.201411220955-1-grsec (all nf* modules loaded)
>> nft: nftables v0.3
>> Network setup via systemd-networkd: br0(bridge) is attached to
>> eth0(physical nic)
>>
> You need these two patches:
>
> http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=68b0faa87d167ec87ba2a26be62241ad94eb449b
> http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=1b63d4b9b54cee6002757a8d20b537aa4037ae8f
>
> They apply to Linux kernel 3.18-rc.
>
> The second patch sets the transport layer offset to get layer 4
> protocol matching from the bridge. Please, I'd appreciate if you can
> give them a test and report, those two are scheduled for 3.19.
Thank you, I am hoping to try it out asap, but I have to setup another
System because the current system is a semi-production machine that I
don't have any other access then ssh, and no grsec patch set is
available for 3.18-rc.
> BTW, I noticed that you're using the 'inet' family. I guess you're
> using bridge netfilter. I think you should use the 'bridge' family
> instead, it comes with native working reject support since the
> upcoming 3.18.
Okay I'll try that when i have 3.18 on my box.
> One of the goals of nftables is to supersede br_netfilter.
>
I am not using br_netfilter, see lsmod output:
sudo lsmod | grep nf :
nf_log_ipv6 6470 2
nf_log_ipv4 5541 2
nf_log_common 4338 2 nf_log_ipv4,nf_log_ipv6
nft_log 3411 2
nf_conntrack_ipv6 12173 4
nf_defrag_ipv6 27646 1 nf_conntrack_ipv6
nf_conntrack_ipv4 12554 4
nf_defrag_ipv4 2435 1 nf_conntrack_ipv4
nft_ct 4498 4
nf_conntrack 86560 3 nft_ct,nf_conntrack_ipv4,nf_conntrack_ipv6
nft_counter 2467 8
nft_meta 4405 29
nft_hash 4219 4
nft_rbtree 3759 0
nf_tables_bridge 2558 0
nf_tables_arp 2546 0
nf_tables_inet 2491 4
nf_tables_ipv6 2878 1 nf_tables_inet
nf_tables_ipv4 2878 1 nf_tables_inet
nf_tables 52221 135
nf_tables_inet,nf_tables_ipv4,nf_tables_ipv6,nft_log,nft_ct,nf_tables_bridge,nft_hash,nft_meta,nft_rbtree,nf_tables_arp,nft_counter
nfnetlink 7016 1 nf_tables
sudo lsmod | grep br :
nf_tables_bridge 2558 0
nf_tables 52221 135
nf_tables_inet,nf_tables_ipv4,nf_tables_ipv6,nft_log,nft_ct,nf_tables_bridge,nft_hash,nft_meta,nft_rbtree,nf_tables_arp,nft_counter
bridge 118306 0
stp 2653 1 bridge
llc 5081 2 stp,bridge
next prev parent reply other threads:[~2014-12-01 15:53 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-25 13:27 nft icmpv6 mld-listener-query rule not honored? stoffl4ever
2014-12-01 12:59 ` Pablo Neira Ayuso
2014-12-01 15:53 ` stoffl4ever [this message]
2014-12-01 16:04 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=547C8EF0.4070200@gmail.com \
--to=stoffl4ever@gmail.com \
--cc=netfilter@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox