Re: [PATCH 2.4] raw table and NOTRACK support

[Roberto Nibali <ratz@tac.ch>]

> Damn! I wish I understood that conntrack stuff better ...

Ok, so NOTRACK registers itself into the conntrack table upon target
entry using nf_conntrack_get((*pskb)->nfct). And each skb updates the
nfct counter, but when deregistering the conntrack we still have
references of the fake connection tracking entry of the NOTRACK hook.
This was discussed already and a Patrick submitted a patchset:

http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b31e5b1bb53b99dfd5e890aa07e943aff114ae1c

Patrick, in the thread leading to this patch we concluded that you would
forward the nf_reset patch to Marcelo for 2.4.x inclusion. I only
realised now that this did not happen and thus the following patch is
needed for 2.4.x to have rmmod ip_conntrack working correctly when
having either bridging or NOTRACK (both not in vanilla) loaded and used
in the kernel:

--- linux-2.4.32-orig/net/ipv4/ip_output.c      2005-11-21 11:29:41 +0100
+++ linux-2.4.32-pab2/net/ipv4/ip_output.c      2005-11-23 11:42:13 +0100
@@ -167,6 +167,9 @@
        nf_debug_ip_finish_output2(skb);
 #endif /*CONFIG_NETFILTER_DEBUG*/

+       /* Drop conntrack reference when packet leaves IP */
+       nf_reset(skb);
+
        if (hh) {
                int hh_alen;

Is there a reason not to include this patch in 2.4.x?

Thanks and regards,
Roberto Nibali, ratz
-- 
-------------------------------------------------------------
addr://Kasinostrasse 30, CH-5001 Aarau tel://++41 62 823 9355
http://www.terreactive.com             fax://++41 62 823 9356
-------------------------------------------------------------
terreActive AG                       Wir sichern Ihren Erfolg
-------------------------------------------------------------