|Main Archive Page > Month Archives > netfilter-devel archives|
On Thursday 2010-04-01 12:37, Patrick McHardy wrote:
>Jan Engelhardt wrote:
>> Since Xtables is now reentrant/nestable, the cloned packet can also go
>> through Xtables and be subject to rules itself.
>That sounds dangerous if conntrack isn't used to prevent loops.
Conntrack loops are prevented by using a dummy conntrack, just as
>Is that really useful? For filtering, you can simply apply the
>rules before deciding to TEE the packet.
I can think of a handful of applications:
- When the cloned packets gets XFRMed or tunneled, its status switches
from "special" to "plain". Doing policy routing on them does not seem
-- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to firstname.lastname@example.org More majordomo info at http://vger.kernel.org/majordomo-info.html