Jan Engelhardt wrote:
> On Wednesday 2010-02-10 16:27, Patrick McHardy wrote:
>
>> Jan Engelhardt wrote:
>>> diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
>>> index 766c6fd..2367953 100644
>>> --- a/net/ipv4/netfilter/iptable_raw.c
>>> +++ b/net/ipv4/netfilter/iptable_raw.c
>>> @@ -41,6 +41,7 @@ static const struct xt_table packet_raw = {
>>> .valid_hooks = RAW_VALID_HOOKS,
>>> .me = THIS_MODULE,
>>> .af = NFPROTO_IPV4,
>>> + .priority = NF_IP_PRI_FIRST,
>> You're changing priorities here, NF_IP_PRI_RAW is not NF_IP_PRI_FIRST.
>
> Aww.. that must have stemmed from ip6table_raw using _FIRST. Will fix.
This might actually be a bug. IPv4 uses:
NF_IP_PRI_FIRST = INT_MIN,
NF_IP_PRI_CONNTRACK_DEFRAG = -400,
NF_IP_PRI_RAW = -300,
NF_IP_PRI_SELINUX_FIRST = -225,
NF_IP_PRI_CONNTRACK = -200,
while IPv6 uses:
NF_IP6_PRI_FIRST = INT_MIN,
NF_IP6_PRI_CONNTRACK_DEFRAG = -400,
NF_IP6_PRI_SELINUX_FIRST = -225,
NF_IP6_PRI_CONNTRACK = -200,
So we actually defragment packets in IPv4 even though they're
untracked. Perhaps Jozsef knows more details why we use
different priorities here.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
