On Tuesday 2009-06-30 22:57, Mark Smith wrote:
>>>
>>> does conntrack ever make sense for bridging? Perhaps
>>> we should get rid of that completely?
>>
>> It makes sense absolutely. Consider:
>>
>> * packet enters bridge
>> * NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, ...) is called by nr_netfilter.c
>> * (connection tracking entry is set up)
>> * let bridging decision be "local delivery"
>quite a lot by it, due to it's quite strange side effects on traffic.
>e.g. it'll defragment bridged IP packets[...]
Hm not good. Then again, Netfilter does not know where the packet comes
from or where it goes, and Bridge does not know that Conntrack is
(potentially, it even varies) part of PREROUTING.
>I'm not sure if it supposed to work on IP traffic carried within
>bridge PPPoE/PPP, but it does
Bridge unpacks such frames if I've seen the code right :-/
if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
IS_PPPOE_IPV6(skb)) {
nf_bridge_pull_encap_header_rcsum(skb);
return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
}
I, too, wonder, why it would unpack PPP here.
However, there is a sysctl flag called vlan_tagged/pppoe_tagged which
you can se to zero to not pull_encap VLAN/PPP.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
