James Morris wrote:

On Sat, 14 Feb 2004, Mika Penttilä wrote:

 

quoted

James Morris wrote:

   

quoted

The proposed solution below is to copy the skb rather than clone it, to 
ensure that the original and looped back packets are independent.

     

This is unneeded overhead for the common case. The right fix is to make 
sure the modifier (netfilter etc) makes the copy if needed. Actually, 
this is what skb_ip_make_writable() is doing.
   

The common case here will be only for locally generated multicast and 
broadcast packets.

If the netfilter core code is modified instead, we will end up adding
skb_ip_make_writable() to nf_hook_slow() which will be called for every 
packet with an output device which uses hardware checksums.

Not sure which is worse, but here's a proposed patch which does this.


- James

I don't see the context here. Where is the packet mangled? Why isn't 
that instance doing skb_ip_make_writable()? selinux? Not everyone 
generating locally multicast/broadcast packets is using selinux...

--Mika