Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Sat, Jan 31, 2015 at 10:47:17PM +0100, Florian Westphal wrote: > > Some issues that I found: > > Doesn't work in INPUT since skb->dev is the bridge port, so we end > > with NULL br_port_get_rcu (no crash, br_deliver is noop). > > > > After fixing INPUT issue, nft reject from bridge works if > > nf-call-iptables is on, most likely due to extra pskb_trim_rcsum > > done by bridge_netfilter before PREROUTING invocation for ipv4. > > > > Adding an explicit call to pskb_trim_rcsum() seemed to make reject > > work from bridge layer in both prerouting and input. > > Will you send me formal submission for this? I considered it ugly kludge but given we're dropping anyway it should be ok. So yes, I'll send you a formal patch, but not this week, sorry :-| > > Untested further possible issues: > > > > seems nf*_ip_checksum() only works for UDP or TCP, not with > > e.g. SCTP or UDPLITE. > > I guess you'll have to add checks in that function for all transport > protocols that we support, may require some ifdefs. Seems ifdefs are not enough, e.g. sctp would need libcrc32c module :-( Not sure what to do at the moment, perhaps only do csum validation for UDP and TCP, and rely on ipv4 csum alone for the rest? For ipv6, this would obviously mean no csum validation except for tcp and udp. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
