On Sun, May 30, 2010 at 09:29:10AM -0400, jamal wrote:

I have constructed a test case (attached) and my fear is unfortunately
still there;-< What am i doing wrong?

The packet path is:
-->eth0-->tcpdump eth0-->pedit-->mirror to dummy0-->tcpdump dummy0

Well this doesn't guarantee a cloned packet at all.  Once af_packet
receives the packet it'll wake up any listeners like tcpdump, if
tcpdump gets to it before pedit runs then the packet won't be
cloned anymore.

Anyway, I don't see why actions are special.  Everybody else lives
by the rule that cloned skbs are not writeable.  So if this was
indeed buggy as you say it would have shown up a long time ago.

Case in point, we had a bug in certain NIC drivers where they
modified cloned skbs for TSO.  This quickly showed up as bogus
packets in tcpdump and we fixed it.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt