On Thu, Dec 19, 2013 at 12:29:02PM +0800, Changli Gao wrote: > On Wed, Dec 18, 2013 at 12:58 AM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > > > With this patch, an ICMP destination unreachable - fragmentation > > needed coming after a big UDP packet will trigger the removal of the > > UDP conntrack entry, that should not happen. > > I don't think this is a problem, as the conntrack is unreplied and the > original packet is dropped. That means the no virtual circuit is setup > along the path, so why do we keep the partial circuit? And the later > restranmitted packet will set up a new conntrack in anyway. There are protocols like RTP running over UDP which do not require to see traffic in both directions, so that partial circuit assumption sounds wrong to me. The behaviour that this patch introduces is sloppy, the flow state information would be released and the counters would be lost in that case. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
