On Wed, 10 Feb 2010, Patrick McHardy wrote:
> Jan Engelhardt wrote:
> > On Wednesday 2010-02-10 16:27, Patrick McHardy wrote:
> >
> >> Jan Engelhardt wrote:
> >>> diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
> >>> index 766c6fd..2367953 100644
> >>> --- a/net/ipv4/netfilter/iptable_raw.c
> >>> +++ b/net/ipv4/netfilter/iptable_raw.c
> >>> @@ -41,6 +41,7 @@ static const struct xt_table packet_raw = {
> >>> .valid_hooks = RAW_VALID_HOOKS,
> >>> .me = THIS_MODULE,
> >>> .af = NFPROTO_IPV4,
> >>> + .priority = NF_IP_PRI_FIRST,
> >> You're changing priorities here, NF_IP_PRI_RAW is not NF_IP_PRI_FIRST.
> >
> > Aww.. that must have stemmed from ip6table_raw using _FIRST. Will fix.
>
> This might actually be a bug. IPv4 uses:
>
> NF_IP_PRI_FIRST = INT_MIN,
> NF_IP_PRI_CONNTRACK_DEFRAG = -400,
> NF_IP_PRI_RAW = -300,
> NF_IP_PRI_SELINUX_FIRST = -225,
> NF_IP_PRI_CONNTRACK = -200,
>
> while IPv6 uses:
>
> NF_IP6_PRI_FIRST = INT_MIN,
> NF_IP6_PRI_CONNTRACK_DEFRAG = -400,
> NF_IP6_PRI_SELINUX_FIRST = -225,
> NF_IP6_PRI_CONNTRACK = -200,
>
> So we actually defragment packets in IPv4 even though they're
> untracked. Perhaps Jozsef knows more details why we use
> different priorities here.
We have to defragment otherwise we could not track and untrack connections
at the same time. Fragments don't carry protocol/port so we cannot tell
which fragment belongs to a not tracked and which one belongs to a tracked
connection.
This is a bug in the IPv6 part then.
Best regards,
Jozsef
-
E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
