Re: SO_ORIGINAL_DST does not work in nat/OUTPUT anymore

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
>>>Yes, I'm also in favour of reverting the patch.  The number of functional bugs
>>>it has caused by far outweigh the gain of save 'rmmod' without loops.
>>
>>Agreed, unfortunately. If we can't get module unload to work reliably we
>>should introduce another way to flush the conntrack table however. I'm
>>thinking of something easy like a /proc file.
> 
> But in the time that passes between echo 1 >/proc/flushme and rmmod new 
> entries could show up, if it's "just" a flush and not a flush-and-disable 
> operation.

"flush-and-disable" (should actually be disable-and-flush) can be
achieved by adding a rule to drop everything before flushing.
Its not meant to clean up before rmmod (conntrack tries to do this
itself) but to kick out old conntrack entries after ruleset changes.

Regards
Patrick