Re: ipq+AF8-set+AF8-verdict problem in bridge+-iptables

["Yong" <sdssly@sina.com>]

Hi Bart,

I have added the 0.0.10 patch and your patch. I can send the large ICMP packet now. Thank you for your help!

Yong
----- Original Message ----- 
From: "Bart De Schuymer" <bdschuym@pandora.be>
To: "Yong" <sdssly@sina.com>; "Harald Welte" <laforge@netfilter.org>
Cc: <netfilter-devel@lists.netfilter.org>
Sent: Thursday, July 17, 2003 1:49 AM
Subject: Re: ipq_set_verdict problem in bridge+iptables


> On Wednesday 16 July 2003 03:09, Yong wrote:
> >  I want to use the iptable_queue in bridge+iptables environment. I can get
> > the packet in userspace using -j QUEUE command. However, If I change the
> > packet size. for example, I change the ping icmp packet size to 400, the
> > packet Ethernet header is changed. In my test, the MAC address is changed
> > to 0xffffffffff. I can capture this packet using sniffer tool. Since the
> > MAC address is changed, the other computer cannot receive the ICMP packet.
> 
> >  It seems that the bridge iptables patch changed something in the function
> > ipq_set_verdict().
> 
> Please test the patch below.
> 
> cheers,
> Bart
> 
> --- linux-2.6.0-test1/net/ipv4/netfilter/ip_queue.c.old 2003-07-16 19:35:07.000000000 +0200
> +++ linux-2.6.0-test1/net/ipv4/netfilter/ip_queue.c 2003-07-16 19:39:05.000000000 +0200
> @@ -353,6 +353,11 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
>   }
>   if (e->skb->sk)
>   skb_set_owner_w(newskb, e->skb->sk);
> +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
> + /* bridged packets already have their Ethernet header */
> + if (e->skb->nf_bridge)
> + memcpy(newskb->data - 16, e->skb->data - 16, 16);
> +#endif
>   kfree_skb(e->skb);
>   e->skb = newskb;
>   }
> 
> 
>