On 06/26/2018 05:44 PM, Cong Wang wrote: > With this, a netns could totally throttle a TCP socket in a different > netns by holding the packets infinitely (e.g. putting them in a loop). > This is where the isolation breaks. > That is fine, really. Admin error -> Working as intended. The current scrubbing is simply wrong, not documented, and added by someone who had absolutely not intended all the side effects. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
