On Thursday 2010-04-01 12:37, Patrick McHardy wrote: >Jan Engelhardt wrote: >> Since Xtables is now reentrant/nestable, the cloned packet can also go >> through Xtables and be subject to rules itself. > >That sounds dangerous if conntrack isn't used to prevent loops. Conntrack loops are prevented by using a dummy conntrack, just as NOTRACK does. >Is that really useful? For filtering, you can simply apply the >rules before deciding to TEE the packet. I can think of a handful of applications: - CLASSIFY - When the cloned packets gets XFRMed or tunneled, its status switches from "special" to "plain". Doing policy routing on them does not seem so far-fetched. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
