From owner-freebsd-net@FreeBSD.ORG Tue Mar 6 07:39:55 2007 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 7FBFE16A401; Tue, 6 Mar 2007 07:39:55 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from pobox.codelabs.ru (pobox.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id 2FCA513C441; Tue, 6 Mar 2007 07:39:55 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from codelabs.ru (pobox.codelabs.ru [144.206.177.45]) by pobox.codelabs.ru with esmtpsa (TLSv1:AES256-SHA:256) id 1HOUH1-0003Q1-BL; Tue, 06 Mar 2007 10:39:51 +0300 Date: Tue, 6 Mar 2007 10:39:46 +0300 From: Eygene Ryabinkin To: "Bruce M. Simpson" Message-ID: <20070306073945.GR57456@codelabs.ru> References: <45E9F1E8.2000802@inse.ru> <20070304062203.GL80319@codelabs.ru> <45E9F1E8.2000802@inse.ru> <20070304160613.GN80319@codelabs.ru> <45EB4915.1090703@FreeBSD.org> <20070305145647.GT80319@codelabs.ru> <45EC3EFD.3000301@FreeBSD.org> MIME-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: <45EC3EFD.3000301@FreeBSD.org> Sender: rea-fbsd@codelabs.ru X-Spam-Status: No, score=-3.4 required=4.0 tests=ALL_TRUSTED,AWL,BAYES_00 Cc: rik@FreeBSD.org, freebsd-net@freebsd.org, glebius@FreeBSD.org, andre@FreeBSD.org, thompsa@FreeBSD.org Subject: Re: kern/109815: wrong interface identifier at pfil_hooks for vlans + if_bridge X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Mar 2007 07:39:55 -0000 Bruce, > >In my case if_bridge drops off the packet because firewall fails to > >recognize the packet as good: the interface that is passed to a > >pfil_hooks is bad (I mean not the one expected). > > > The ifp which your patch changes is that of the mbuf chain when bridge_input >determines it is not for the bridge, but should be forwarded locally. The patch > forces a locally forwarded frame to have the same ifp as it had when it came > into bridge_input. I can foresee problems if the same Ethernet destination > address exists on multiple bridge member interfaces. The code in the if_bridge.c changes the ifp anyway: I am just setting the ifp to a more sane value. > NetBSD consistently uses pfil_hooks for the if_bridge *and* ether_input paths, > FreeBSD currently calls ipfw directly for ether_input, which may make a > difference to the behaviour which you are seeing with VLANs. I am awfully sorry, but you're seem to be mistaken: if_bridge calls the ipfw directly only for the L2 filtering (when the net.link.bridge.ipfw is set to 1). This is processed by the block in if_bridge just above to the 'ipfwpass' label. But the L3 filtering is done fully by the pfil hooks, as I understand the code. Moreover, I am using 'pf' in my case, not the ipfw. >Not understanding if_bridge fully, or the coupling of ipfw with if_ethersubr.c, >I would hope that Andrew and others have more to say on this. I am too ;)) Thank you! -- Eygene