On Sat, Aug 23, 2008 at 08:35:07PM -0400, Jan Engelhardt wrote: > > On Friday 2008-08-22 07:30, adobriyan@xxxxxxxxx wrote: > > > >We wait for untracked ct refcount to drop to 1 back: > > > > /* wait until all references to nf_conntrack_untracked are dropped */ > > while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1) > > schedule(); > > > >Consequently it should be one per netns, otherwise netns A can prevent > >netns B from stopping. > > > > But nf_conntrack_cleanup is not per netns, is it? That's because nf_conntrack_cleanup() is _code_. If netns A actively uses NOTRACK, untracked ct refcount will be bumped. And netns B which haven't used NOTRACK at all will wait for netns A to stop using NOTRACK potentially indefinitely. > At least I do not think it should be. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
