On Sat, Oct 29, 2016 at 03:01:50AM +0200, Florian Westphal wrote: > The (percpu) untracked conntrack entries can end up with nonzero connmarks. > > The 'untracked' conntrack objects are merely a way to distinguish INVALID > (i.e. protocol connection tracker says payload doesn't meet some > requirements or packet was never seen by the connection tracking code) > from packets that are intentionally not tracked (some icmpv6 types such as > neigh solicitation, or by using 'iptables -j CT --notrack' option). > > Untracked conntrack objects are implementation detail, we might as well use > invalid magic address instead to tell INVALID and UNTRACKED apart.
We may consider recovering this old idea: https://lwn.net/Articles/141489/ > Check skb->nfct for untracked dummy and behave as if skb->nfct is NULL. > > Reported-by: XU Tianwen <[email protected]> > Signed-off-by: Florian Westphal <[email protected]> > --- > Here is the formal submit of earlier RFC patch, I also fixed > connmark match; conceptually UNTRACKED is not a conntrack object > so such skb should always fail the match. Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
