On Sat, Jan 31, 2015 at 10:47:17PM +0100, Florian Westphal wrote: > Some issues that I found: > Doesn't work in INPUT since skb->dev is the bridge port, so we end > with NULL br_port_get_rcu (no crash, br_deliver is noop). > > After fixing INPUT issue, nft reject from bridge works if > nf-call-iptables is on, most likely due to extra pskb_trim_rcsum > done by bridge_netfilter before PREROUTING invocation for ipv4. > > Adding an explicit call to pskb_trim_rcsum() seemed to make reject > work from bridge layer in both prerouting and input. Will you send me formal submission for this? > Untested further possible issues: > > seems nf*_ip_checksum() only works for UDP or TCP, not with > e.g. SCTP or UDPLITE. I guess you'll have to add checks in that function for all transport protocols that we support, may require some ifdefs. We may still reply to unknown transport protocols depending on the iptables configuration, but there's little we can do on that. Thanks Florian. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
