On Fri, Aug 19, 2011 at 01:58:10PM -0700, Stephen Hemminger wrote: > The IEEE standard expects that link local multicast packets will not > be forwarded by a bridge. But there are cases like 802.1X which may > require that packets be forwarded. For maximum flexibilty implement > this via netfilter. > > The netfilter chain is slightly different from other chains in that > if packet is ACCEPTED by the chain, it means it should be forwarded. > And if the packet verdict result is DROP, the packet is processed > as a local packet. Exactly this functionality already exists by way of the BROUTING chain in the broute table. Currently, link-local packets are hardcodedly treated as local before they even reach that chain. Nick's patch, in conjunction with BROUTING, provides exactly what you're trying to do. Now, without bridge netfilter, your patch becomes rather useless while Nick's patch still allows per-group (and therefore per-protocol) control. Further, Nick's patch is considerably less intrusive. I would therefore ask for Nick's patch to be merged. -David P.S.: this whole issue is starting to get rather annoying -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
