Messages in this thread | | | Subject | Re: 2.6.12: connection tracking broken? | From | Bart De Schuymer <> | Date | Mon, 20 Jun 2005 06:39:35 +0000 |
| |
Op ma, 20-06-2005 te 04:45 +0200, schreef Patrick McHardy: > On Mon, 20 Jun 2005, Herbert Xu wrote: > > Patrick McHardy <kaber@trash.net> wrote: > >> > >> The bridge-netfilter code defers calling of some NF_IP_* hooks to the > >> bridge layer, when the conntrack reference is already gone, so the entry > > > > Why does it defer them at all? Shouldn't the fact that the device is > > bridged be transparent to the IP layer? > > I couldn't figure out the reason, it seems to have something to do > with setting up device pointers for iptables and ebtables. It looks > like the only way to fix this problem without keeping the conntrack > reference while packets are queued at the device is to avoid defering > the NF_IP_* hooks. Bart, can you explain why the hooks are defered > please?
This is done so that iptables knows which bridge port the output device is, using the iptables physdev match.
Can't you release the conntrack reference with a function registered on the POSTROUTING hook with a prio higher than nat POSTROUTING (or something like that)?
cheers, Bart
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |