Re: conntrackd user-space helpers for multicast/broadcast

Pablo Neira Ayuso <[email protected]> Wed, 12 Nov 2025 10:44:44 +0100
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <aRRXDBQBQ9vogZg2@calendula>
On Sun, Nov 09, 2025 at 11:46:00PM +0000, Joel Low wrote:
> Hi Pablo,
> 
> > -----Original Message-----
> > From: Pablo Neira Ayuso <[email protected]>
> > Sent: Monday, 10 November 2025 2:21 am
> > To: Joel Low <[email protected]>
> > Cc: [email protected]
> > Subject: Re: conntrackd user-space helpers for multicast/broadcast
> > 
> > Hi,
> > 
> > Are you using the br_netfilter module in your setup?
> 
> I don't think so; `lsmod | grep br_` returns nothing on that host.

And no built-in CONFIG_BRIDGE_NETFILTER=y?

It should be possible to fix this by dropping the conntrack in the
queue path, then nfqnl_ct_parse() performs a ct lookup from the
reinject path.