Re: [PATCH] bridge: make bridge-nf-call-*tables default configurable

Mark McLoughlin wrote:

With BRIDGE_NETFILTER enabled, bridge traffic is passed through
netfilter as it is forwarded across the bridge. This is a useful
feature in specialized cases where the admin wishes to filter bridge
traffic based on higher-level protocol headers.

However, in a lot of cases, it causes a large amount of confusion
since it is so counter-intuitive - nobody expects their IP firewall
rules to also apply to traffic on their bridges.

This is especially true for virtualization, where users create a
bridge and find that some types of traffic work and others don't, and
it can take quite some time to identify iptables as the culprit. Users
are often recommended to configure their iptables rules to ACCEPT
"physdev-is-bridged" in order to avoid this confusion.

However, because nf_conntrack introduces an skb_orphan(), it is now
recommended that bridge-nf-call-iptables be disabled completely so as
to ensure features like TUNSETSNDBUF work as expected.

For these reasons, it makes sense to allow distributions to disable
netfilter on the bridge by default and require those specialized users
to enable it explicitly via sysctl.

I agree that this makes sense, at least temporarily. Mid-term
we should really fix the defaults, so it would be good to have a
feature-removal-schedule and maybe a runtime warning stating that
these defaults will change.