From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756646Ab2ADRzf (ORCPT ); Wed, 4 Jan 2012 12:55:35 -0500 Received: from juliette.telenet-ops.be ([195.130.137.74]:40889 "EHLO juliette.telenet-ops.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751000Ab2ADRze (ORCPT ); Wed, 4 Jan 2012 12:55:34 -0500 Message-ID: <4F049290.3090803@pandora.be> Date: Wed, 04 Jan 2012 18:55:28 +0100 From: Bart De Schuymer User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20111105 Thunderbird/8.0 MIME-Version: 1.0 To: Richard Weinberger CC: Stephen Hemminger , davem@davemloft.net, bridge@lists.linux-foundation.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org Subject: Re: [PATCH] netfilter: Fix br_nf_pre_routing() in conjunction with bridge-nf-call-ip(6)tables=0 References: <4F025A07.2000304@nod.at> <1325597164-13459-1-git-send-email-richard@nod.at> <1325597164-13459-2-git-send-email-richard@nod.at> <20120103081521.2fec3a29@nehalam.linuxnetplumber.net> <4F033E11.5060707@nod.at> <4F0361D7.3000602@pandora.be> <4F03650D.8050200@nod.at> In-Reply-To: <4F03650D.8050200@nod.at> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Antivirus: avast! (VPS 120104-0, 04/01/2012), Outbound message X-Antivirus-Status: Clean Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Op 3/01/2012 21:29, Richard Weinberger schreef: > Am 03.01.2012 21:15, schrieb Bart De Schuymer: >> The documentation is probably not explicit enough, but I would keep the >> behavior as it is now. Setting bridge-nf-call-iptables to 0 makes >> iptables behave as if bridge-netfilter was not enabled at compilation. >> Anyway, your patch is almost certainly flawed since the fact that >> skb->nf_bridge can be NULL is used as part of the logic in >> br_netfilter.c: it indicates that bridge-nf-call-iptables was 0 when the >> packet was first processed by bridge-netfilter and should therefore not >> be given to iptables in any other netfilter hook. > Thanks for the explanation! > > Wouldn't it make sense to check for bridge-nf-call-iptables in xt_physdev? > So that the user gets warned that his iptables rule will never match... We don't want to introduce module dependencies between the bridge module and the iptables physdev match. We could add a message to the syslog whenever these proc settings are changed (in br_netfilter.c::brnf_sysctl_call_tables()). cheers, Bart -- Bart De Schuymer www.artinalgorithms.be