mac table updates
Subsystems (2)
I think the new mac ageing (sometime since 2.6.8.1) may be too aggressive.
Now it updates the table at a much later time, with a comment in the code that leads me to believe this is to prevent counting spoofed packets and a DOS.
My problem is that the update occurs after the netfilter hooks which may do weird things to change the course of the packet so that it does not get counted. (in my case, redirecting, queueing to userspace, nonlocally bound sockets, etc).
For me this causes packets to go spewing out on the wrong interface when the timer expires.
I used the attached patch to revert back to the old method.
-Dirk
net/bridge/br_input.c +2 -1
@@ -111,7 +111,8 @@if (!is_valid_ether_addr (eth_hdr (skb)->h_source)) goto err; -if (p->state ==BR_STATE_LEARNING ) +if (p->state ==BR_STATE_LEARNING || + p->state ==BR_STATE_FORWARDING )br_fdb_update (p->br, p,eth_hdr (skb)->h_source); if (p->br->stp_enabled &&
Quoted 13 lines · On Thu, 28 Jul 2005 16:23:43 -0700 Dirk Morris <[email protected]> wrote:
I think the new mac ageing (sometime since 2.6.8.1) may be too aggressive. Now it updates the table at a much later time, with a comment in the code that leads me to believe
this is to prevent counting spoofed packets and a DOS.My problem is that the update occurs after the netfilter hooks which may do weird things to change the course of the packet so that it does not get counted.
(in my case, redirecting, queueing to userspace, nonlocally bound sockets, etc).
For me this causes packets to go spewing out on the wrong interface when the timer expires.
Quoted 3 lines
I used the attached patch to revert back to the old method.
-Dirk
If you are whacking the source address, that seems wrong. The fix for that would be to copy the original source address somewhere, then extract it back afterwards.
Quoted 14 lines
Quoted 14 lines
I think the new mac ageing (sometime since 2.6.8.1) may be too aggressive. Now it updates the table at a much later time, with a comment in the code that leads me to believe
this is to prevent counting spoofed packets and a DOS.My problem is that the update occurs after the netfilter hooks which may do weird things to change the course of the packet so that it does not get counted.
(in my case, redirecting, queueing to userspace, nonlocally bound sockets, etc). For me this causes packets to go spewing out on the wrong interface when the timer expires.
Quoted 8 lines
Quoted 3 lines
I used the attached patch to revert back to the old method.
If you are whacking the source address, that seems wrong. The fix for that would be to copy the original source address somewhere, then extract it back afterwards.
I think I was leaving the source address, but I was queueing to userspace, which causes the packet to "disappear" from the kernel, meaning the update code was just never reached.