Hi Marcelo, On Thu, Dec 24, 2015 at 10:50:28AM -0200, Marcelo Ricardo Leitner wrote: > I can see how it would work for the vtag-tracking scenario, I think. I'm > just not seeing the non-tracking one (routers in the middle) yet. > It doesn't seem it can fit the helper way because it can't prepare > expectations as it doesn't see the packets in the initial path, > meaning that we would have to have 2 ways of handling such new > entries. We assume that conntrack sees all traffic in our existing helpers, think of tcp. Otherwise, we may classify packets as invalid if we don't all packets that belong to the flow. > It would work like: if the helper is not present, allow heartbeats with any > vtag like it currently is. Otherwise, for validating vtag too, only allow > them via expectations. I'm starting to think the lazy multihoming support is problematic since you can actually allow pushing holes into the firewall, how easy would be to push holes with this mode? You can probably achieve the same effect by allowing heartbearts go through via NOTRACK and then have some connection pickup from the middle feature. That, however, would make the user fully aware of the limitations since it would require explicit configuration. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
