Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1295130

Re: [PATCH] ila: add NETFILTER dependency

Show all headers | View raw

On Fri, Dec 18, 2015 at 07:09:31PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > I'm afraid this extra Kconfig dependency that Arnd adds to fix this is
> > a symptom that there is something that doesn't belong there.
> > 
> > I overlook this new hook on priority -1, how does this integrate into
> > our infrastructure?
> 
> Looks problematic since address changes post ipv6 dnat translations,
> its certainly unexpected for nft since we have magic address mangling
> after -2 and 0 priroized tables...

David indicated that this should be sort of transparent and integrated
into separated infrastructure.

The existing hook will break IPv6 conntrack and NAT for us, and the
extra hook is suboptimal as it

I'd suggest you add a static key and specific hook before netfilter to
deal with this.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] ila: add NETFILTER dependency Arnd Bergmann <arnd@arndb.de> - 2015-12-18 15:40 +0100
  Re: [PATCH] ila: add NETFILTER dependency Pablo Neira Ayuso <pablo@netfilter.org> - 2015-12-18 18:30 +0100
    Re: [PATCH] ila: add NETFILTER dependency Florian Westphal <fw@strlen.de> - 2015-12-18 19:10 +0100
      Re: [PATCH] ila: add NETFILTER dependency Pablo Neira Ayuso <pablo@netfilter.org> - 2015-12-18 21:40 +0100
  Re: [PATCH] ila: add NETFILTER dependency David Miller <davem@davemloft.net> - 2015-12-18 20:20 +0100

csiph-web