![]() | |||||||||||||
Messages in this thread |
Op ma, 20-06-2005 te 04:45 +0200, schreef Patrick McHardy: > On Mon, 20 Jun 2005, Herbert Xu wrote: > > Patrick McHardy <kaber@trash.net> wrote: > >> > >> The bridge-netfilter code defers calling of some NF_IP_* hooks to the > >> bridge layer, when the conntrack reference is already gone, so the entry > > > > Why does it defer them at all? Shouldn't the fact that the device is > > bridged be transparent to the IP layer? > > I couldn't figure out the reason, it seems to have something to do > with setting up device pointers for iptables and ebtables. It looks > like the only way to fix this problem without keeping the conntrack > reference while packets are queued at the device is to avoid defering > the NF_IP_* hooks. Bart, can you explain why the hooks are defered > please? This is done so that iptables knows which bridge port the output device is, using the iptables physdev match. Can't you release the conntrack reference with a function registered on the POSTROUTING hook with a prio higher than nat POSTROUTING (or something like that)? cheers, Bart - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-06-20 06:29 [from the cache] ©2003-2008 | |||||||||||||