On Wed, Jan 10, 2018 at 08:51:57PM -0700, Subash Abhinov Kasiviswanathan wrote: > conntrack defrag is needed only if some module like CONNTRACK or NAT > explicitly requests it. For plain forwarding scenarios, defrag is > not needed and can be skipped if NOTRACK is set in a rule. > > Since conntrack defrag is currently higher priority than raw table, > setting NOTRACK is not sufficient. We need to move raw to a higher > priority for iptables only. > > This is achieved by introducing a module parameter "raw_before_defrag" > which allows to change the priority of raw table to place it before > defrag. By default, the parameter is disabled and the priority of raw > table is NF_IP_PRI_RAW to support legacy behavior. If the module > parameter is enabled, then the priority of the raw table is set to > NF_IP_PRI_RAW_BEFORE_DEFRAG. Applied, thanks a lot Subash! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
