Op 3/01/2012 21:29, Richard Weinberger schreef:

Am 03.01.2012 21:15, schrieb Bart De Schuymer:

quoted

The documentation is probably not explicit enough, but I would keep the
behavior as it is now. Setting bridge-nf-call-iptables to 0 makes
iptables behave as if bridge-netfilter was not enabled at compilation.
Anyway, your patch is almost certainly flawed since the fact that
skb->nf_bridge can be NULL is used as part of the logic in
br_netfilter.c: it indicates that bridge-nf-call-iptables was 0 when the
packet was first processed by bridge-netfilter and should therefore not
be given to iptables in any other netfilter hook.

Thanks for the explanation!

Wouldn't it make sense to check for bridge-nf-call-iptables in xt_physdev?
So that the user gets warned that his iptables rule will never match...

We don't want to introduce module dependencies between the bridge module 
and the iptables physdev match.
We could add a message to the syslog whenever these proc settings are 
changed (in br_netfilter.c::brnf_sysctl_call_tables()).

cheers,
Bart


-- 
Bart De Schuymer
www.artinalgorithms.be