queuing to userspace for the bridge family, using nftables

queuing to userspace for the bridge family, using nftables

[stéphane bryant]

Hello,

We are currently working on a project which may need the use of nftables
to queue AF_BRIDGE packets to the userspace and back. Apparently this is
already supported in the nftables code itself, but not in the bridge
netfilter code (the corresponding nf_afinfo is missing, at least).

I would like to know if there are plans to support this? If yes, in what
timeframe? If no, would you be interested if we were to submit a patch
to that effect?
Also, a. what should be included in the payload send to userspace?
(starting from the 802.3 LLC/protocol header, or also including up to
the MAC addresses ?) b. alternatively, shouldn't the dest MAC address be
added to the netlink attributes sent to userspace?

regards
stephane bryant

Re: queuing to userspace for the bridge family, using nftables

[Pablo Neira Ayuso]

On Mon, Oct 06, 2014 at 07:26:42PM +0200, stéphane bryant wrote:
> Hello,
> 
> We are currently working on a project which may need the use of nftables
> to queue AF_BRIDGE packets to the userspace and back. Apparently this
> is already supported in the nftables code itself, but not in the
> bridge netfilter code (the corresponding nf_afinfo is missing, at least).
> 
> I would like to know if there are plans to support this? If yes, in what
> timeframe? If no, would you be interested if we were to submit a patch
> to that effect?

Please, submit patches.

> Also, what should be included in the payload send to userspace?
> (starting from the 802.3 LLC/protocol header, or also including up to
> the MAC addresses ?)

I think you have to include everything relevant from layer 2 upward. I
think it would be good if we indicate userspace that NFQA_PAYLOAD
starts from the mac header some way. So the same process can handle
packets coming from bridge and the ip layer.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

queuing to userspace for the bridge family, using nftables

[stéphane bryant]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

We are currently working on a project which may need the use of nftables
to queue AF_BRIDGE packets to the userspace and back. Apparently this
is already supported in the nftables code itself, but not in the
bridge netfilter code (the corresponding nf_afinfo is missing, at least).

I would like to know if there are plans to support this? If yes, in what
timeframe? If no, would you be interested if we were to submit a patch
to that effect?
Also, what should be included in the payload send to userspace?
(starting from the 802.3 LLC/protocol header, or also including up to
the MAC addresses ?)

regards
stephane bryant
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJUMtDSAAoJEKNzxWR1tbW0wfIP/ix2furH4/z6Kxl2lAFtCoiJ
S783U0TosC1rZG394a81Myxm+QrdGPzpJ0nLOnAaztNy7cqxxnnzBdqd1A40vaZ1
LnCI+aC5yo9qqc7FRljovMSKgaQ5UI2Hf2Tcd2RaoB1j4GVn+fd2GxbX2fls6JaC
c2U/5plUfRkAeM43ggCDFMwBpl3UhUbz8NutZ9H2vN7BnEIQvtB6ixbzNaDfqUpn
JuXW2x19UfADBlxVzNon//nWJjloWQTsO1DN2jlciwatbMQnBF+e4GNHyRB8T34Q
Dsd+HOSX/YT8Wuzi9PeXkq/k1IAxG6PDygu56WqBDM4nzZUpwvKiGIQ2Mb8pYbVv
ImTy2T6mn+aPVwSPyCVNpF3PNzWKZCFvkDJdSdbW/r6u1ZecIIzEmvdX5dWPpx3b
7+x/NlBlKAKXABBxinXsSsaHNNVTyB0lDltbcd87knG/0nWrLUwj+j9K8VRUki/t
DbK8Kt5cAhmjVUUdNo9RS6TNhvCDMF0oGdVrV2yU+cJXsffc4afmjnF0QnxNQj7c
ctIXbZTVO8UPC3Jp0DdeI6cyXTFU+1meKhZNasoQmqaWElnfQ9XqZ7SXT8+XZZlT
Jrl8t2gwB7Qb5EByiOIwKLkU4p3c+nSegi2IGRvm9rCvk119R8RuLro4fRogS5Uw
p2NdVo7EFQ6VDX8bscuH
=2H16
-----END PGP SIGNATURE-----