Am 2. Oktober 2014 12:51:03 MESZ, schrieb Florian Westphal <fw@xxxxxxxxx>:
>Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
>> You can use physdev to match the physical interface enslaved to the
>> bridge device. This information is stored in skb->nf_bridge and it is
>> set up by br_netfilter. So, this is only available when iptables is
>> used from the bridge netfilter path.
>>
>> Since 34666d4 ("netfilter: bridge: move br_netfilter out of the
>core"),
>> the br_netfilter code is modular. To reduce the impact of this
>change,
>> we can autoload the br_netfilter if the physdev match is used since
>> we assume that the users need br_netfilter in place.
>
>Good idea. I'd suggest to add a dummy dependency and have userspace
>take
>care of this -- just like we do for nf_defrag.
Yes, the symbol dependency is enough, we don't need any manual module refcounting.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
