Messages in this thread | | | Date | Thu, 14 Jan 2010 09:39:12 +0100 | From | Patrick McHardy <> | Subject | Re: [PATCH v4] tcp: harmonize tcp_vx_rcv header length assumptions |
| |
Joe Perches wrote: > On Wed, 2010-01-13 at 16:13 -0500, William Allen Simpson wrote: >> I did today's tests on tcp_ipv4, but part of this harmonization is to >> make v4 and v6 match up better. As I was examining line by line, one of >> the things that leaps out is that ipv4 has nf_reset(skb): >> >> tcp_ipv4: >> if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) >> goto discard_and_relse; >> nf_reset(skb); >> >> if (sk_filter(sk, skb)) >> goto discard_and_relse; >> >> tcp_ipv6: >> if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) >> goto discard_and_relse; >> >> if (sk_filter(sk, skb)) >> goto discard_and_relse; >> >> Does anybody know why? Should ipv6 have it? Or at least a comment >> explaining the reasoning for the omission? > > You should ask the person that put the line in, but > it might be because no IPv6 NAT support exists. > > $ git blame -L 1658,1658 net/ipv4/tcp_ipv4.c > b59c2701 (Patrick McHardy 2006-01-06 23:06:10 -0800 1658) nf_reset(skb); > > And > > $ git log -p -1 b59c2701 > commit b59c270104f03960069596722fea70340579244d > Author: Patrick McHardy <kaber@trash.net> > Date: Fri Jan 6 23:06:10 2006 -0800 > > [NETFILTER]: Keep conntrack reference until IPsec policy checks are done > > Keep the conntrack reference until policy checks have been performed for > IPsec NAT support. The reference needs to be dropped before a packet is > queued to avoid having the conntrack module unloadable.
In IPv6 it is released in ip6_input.c before the packet is handed to the protocol handler.
| |