netfilter-devel April 2010 archive
Main Archive Page > Month Archives  > netfilter-devel archives
netfilter-devel: Re: [PATCH 5/5] netfilter: xt_TEE: have cloned

Re: [PATCH 5/5] netfilter: xt_TEE: have cloned packet travel through Xtables too

From: Jan Engelhardt <jengelh_at_nospam>
Date: Thu Apr 01 2010 - 11:03:49 GMT
To: Patrick McHardy <kaber@trash.net>

On Thursday 2010-04-01 12:37, Patrick McHardy wrote:

>Jan Engelhardt wrote:
>> Since Xtables is now reentrant/nestable, the cloned packet can also go
>> through Xtables and be subject to rules itself.
>
>That sounds dangerous if conntrack isn't used to prevent loops.

Conntrack loops are prevented by using a dummy conntrack, just as
NOTRACK does.

>Is that really useful? For filtering, you can simply apply the
>rules before deciding to TEE the packet.

I can think of a handful of applications:
 - CLASSIFY

 - When the cloned packets gets XFRMed or tunneled, its status switches
   from "special" to "plain". Doing policy routing on them does not seem
   so far-fetched.
-- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html