Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to bridge device

From	Pablo Neira Ayuso <pablo@netfilter.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to bridge device
Date	2017-03-15 23:10 +0100
Message-ID	<tlphg-5w5-9@gated-at.bofh.it> (permalink)
References	(1 earlier) <tlelQ-6g0-9@gated-at.bofh.it> <tleFc-6nm-19@gated-at.bofh.it> <tlips-wL-13@gated-at.bofh.it> <tllGG-2YN-23@gated-at.bofh.it> <tlouR-4Xh-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Mar 15, 2017 at 10:16:19PM +0100, Linus Lüssing wrote:
> On Wed, Mar 15, 2017 at 07:15:39PM +0100, Pablo Neira Ayuso wrote:
> > Could you update ebtables dnat to check if the ethernet address
> > matches the one of the input bridge interface, so we mangle the
> > ->pkt_type accordingly from there, instead of doing this from the
> > core?
> 
> Actually, that was the approach I thought about and went for first
> (and it would probably work for me). Just checking against the
> bridge device's net_device::dev_addr.
> 
> I scratched it though, as I was afraid that the issue might still
> exist for people using some other upper device on top of the bridge
> device. For instance, macvlan? And iterating over the
> net_device::dev_addrs list seemed too costly for fast path to me.

I was more thinking of following the simple approach that we follow in
ebt_redirect_tg() by taking the input interface.

Anyway, I'm ok with this.

Thread

[PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to bridge device Linus Lüssing <linus.luessing@c0d3.blue> - 2017-03-15 04:20 +0100
  Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Florian Westphal <fw@strlen.de> - 2017-03-15 11:30 +0100
    Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Pablo Neira Ayuso <pablo@netfilter.org> - 2017-03-15 11:50 +0100
      Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Linus Lüssing <linus.luessing@c0d3.blue> - 2017-03-15 15:50 +0100
        Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Pablo Neira Ayuso <pablo@netfilter.org> - 2017-03-15 19:20 +0100
          Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Linus Lüssing <linus.luessing@c0d3.blue> - 2017-03-15 22:20 +0100
            Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Pablo Neira Ayuso <pablo@netfilter.org> - 2017-03-15 23:10 +0100
              Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Pablo Neira Ayuso <pablo@netfilter.org> - 2017-03-17 14:20 +0100
                Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Linus Lüssing <linus.luessing@c0d3.blue> - 2017-03-19 18:20 +0100
                Re: [Bridge] [PATCH net] bridge: ebtables: fix reception of frames  DNAT-ed to bridge device Linus Lüssing <linus.luessing@c0d3.blue> - 2017-03-21 02:20 +0100
                Re: [Bridge] [PATCH net] bridge: ebtables: fix reception of frames  DNAT-ed to bridge device Pablo Neira Ayuso <pablo@netfilter.org> - 2017-03-21 11:20 +0100
  Re: [PATCH net] bridge: ebtables: fix reception of frames DNAT-ed to  bridge device Pablo Neira Ayuso <pablo@netfilter.org> - 2017-03-15 11:40 +0100

csiph-web