lkml.org 
[lkml]   [2010]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: batman-adv: design suggestions
    Date
    Vasiliy Kulikov wrote:
    > On Tue, Aug 10, 2010 at 00:34 +0400, Vasiliy Kulikov wrote:
    > > 2) It seems to me that NF_HOOK() at hard-interface.c:458 is misused:
    > > ...
    > >
    > > ret = NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, dev, NULL,
    > >
    > > batman_skb_recv_finish);
    > >
    > > if (ret != 1)
    > >
    > > goto err_out;
    > >
    > > /* packet should hold at least type and version */
    > > if (unlikely(skb_headlen(skb) < 2))
    > >
    > > goto err_free;
    > >
    > > /* expect a valid ethernet header here. */
    > > if (unlikely(skb->mac_len != sizeof(struct ethhdr)
    > >
    > > || !skb_mac_header(skb)))
    > >
    > > goto err_free;
    > >
    > > ...
    > >
    > > static int batman_skb_recv_finish(struct sk_buff *skb)
    > > {
    > >
    > > return NF_ACCEPT;
    > >
    > > }
    > >
    > > As I understand, if there is any hook that returns NF_STOLEN, then skb
    > > is leaked.
    >
    [...]

    > b) Why do you use bridge tables at all? This layer does not know
    > anything about batman layer, only ethernet that is only a tunnel for
    > batman. So, it is able to hook traffic from concrete prev-hop routers,
    > but not from original sources of packets. I think it is not enough for
    > network filter.
    > Also if you want to process [*] cases you have to append fake
    > ethernet headers before network header as NF_HOOK() would use ethernet
    > header.

    Because a different person (no one from the actual development team) wanted to
    have it for testing purposes. Maybe we just drop it again.

    thanks,
    Sven
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2010-08-14 01:27    [W:0.023 / U:0.464 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site