[Bridge] Revert 462fb2af9788a82a534f8184abfde31574e1cfa0 (bridge : Sanitize skb before it enters the IP stack)
David Newall
davidn at davidnewall.com
Thu May 22 03:50:05 UTC 2014
On 22/05/14 04:21, Bart De Schuymer wrote:
> There's no reason why they should overlap in the cb: it's 48 bytes
> big, so big enough to hold both struct br_input_skb_cb and struct
> inet_skb_parm.
No reason, aside from the math, I think. Those 48 bytes appear to be
used for 16 bytes of ip_options plus up to 40 bytes of options data, so
we're using pretend-space; of which we'd need more to squeeze
br_input_skb_cb in at the same time.
I hate opening a second can of worms, but, if I read this right, IPCB is
quite, quite broken.
> As for your other remark: as I've said before, if you don't like
> bridge-netfilter then don't compile it into your kernel.
That's not very helpful. I could say, with just as much merit, that it
should be marked deprecated (so that it's not compiled into distribution
kernels) and you can compile it into yours.
What I dislike is that bridge-netfilter is faulty.
More information about the Bridge
mailing list