Re: 2.6.12: connection tracking broken?
Patrick McHardy <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel,gmane.linux.kernel,gmane.linux.network.bridge.ebtables.devel |
|---|---|
| Message-ID | <[email protected]> |
Bart De Schuymer wrote: > Op di, 21-06-2005 te 17:16 +0200, schreef Patrick McHardy: > >>I unfortunately don't see a way to remove it, but we should keep >>thinking about it. Can you please check if the attached patch is >>correct? It should exclude all packets handled by bridge-netfilter >>from having their conntrack reference dropped. I didn't add nf_reset()'s >>to the bridging code because with tc actions the packets can end up >>anywhere else anyway, and this will hopefully get fixed right sometime. > > Looks good. Thanks. > Perhaps a compile time option to disable postponing the hooks would be > nice... I think we want to reduce the number of possible paths to ideally one, not make them a compile-time option. Regards Patrick