From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Changli Gao <xiaosuo@gmail.com>
Cc: Oliver <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>,
xiaosuo@gmail.xom,
Netfilter Developer Mailing List
<netfilter-devel@vger.kernel.org>
Subject: Re: [PATCH] netfilter: Kill unreplied conntracks by ICMP errors
Date: Tue, 17 Dec 2013 17:58:21 +0100 [thread overview]
Message-ID: <20131217165821.GA13951@localhost> (raw)
In-Reply-To: <CABa6K_EoH23P8OYEDRhA4ihgKeZ-0OtW4gU0CcRLh2jDk3=8OA@mail.gmail.com>
On Tue, Dec 17, 2013 at 10:52:02PM +0800, Changli Gao wrote:
> On Tue, Dec 17, 2013 at 9:01 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> >
> > Indeed. You can configure those two NATs to make them more
> > hole-punching friendly by dropping UDP packets to local closed ports,
> > so that conntrack entry won't be created.
>
> Yes. But it requires the explicit configuration. Why not make it work
> by default, although it may fail in some situation? Less is better
> than none, isn't it?
With this patch, an ICMP destination unreachable - fragmentation
needed coming after a big UDP packet will trigger the removal of the
UDP conntrack entry, that should not happen.
next prev parent reply other threads:[~2013-12-17 16:58 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-12 15:19 [PATCH] netfilter: Kill unreplied conntracks by ICMP errors Changli Gao
2013-12-15 6:57 ` Oliver
2013-12-17 13:01 ` Pablo Neira Ayuso
2013-12-17 14:52 ` Changli Gao
2013-12-17 16:58 ` Pablo Neira Ayuso [this message]
2013-12-19 4:29 ` Changli Gao
2013-12-19 19:51 ` Pablo Neira Ayuso
2013-12-17 14:46 ` Changli Gao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131217165821.GA13951@localhost \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa \
--cc=xiaosuo@gmail.com \
--cc=xiaosuo@gmail.xom \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.