On 13/04/11 14:28, Patrick McHardy wrote: > I see, you're talking about unfulfilled expectations. Still, we're > releasing expectations in destroy_conntrack(), if we fix the refcount > issue, the master conntrack will not be destroyed while userspace > expectations exist. I missed one point. We don't seem to increase the refcnt for unfulfilled expectations. The following example shows a unfulfilled FTP expectation: # conntrack -L exp 262 proto=6 src=192.168.1.128 dst=130.89.149.226 sport=0 dport=20412 conntrack v1.0.0 (conntrack-tools): 1 expectations have been shown. # conntrack -L tcp 6 431979 ESTABLISHED src=192.168.1.128 dst=130.89.149.226 sport=37348 dport=21 packets=9 bytes=503 src=130.89.149.226 dst=192.168.1.128 sport=21 dport=37348 packets=8 bytes=564 [ASSURED] mark=0 delta-time=29 use=1 The use field of the master conntrack shows 1. So, I think that these patches are still the way to fix the problem with the expectations created through ctnetlink. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
