Re: [PATCH 3/4] netfilter: xtables: use xt_table for hook instantiation

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> On Wednesday 2010-02-10 16:27, Patrick McHardy wrote:
> 
>> Jan Engelhardt wrote:
>>> diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
>>> index 766c6fd..2367953 100644
>>> --- a/net/ipv4/netfilter/iptable_raw.c
>>> +++ b/net/ipv4/netfilter/iptable_raw.c
>>> @@ -41,6 +41,7 @@ static const struct xt_table packet_raw = {
>>>  	.valid_hooks =  RAW_VALID_HOOKS,
>>>  	.me = THIS_MODULE,
>>>  	.af = NFPROTO_IPV4,
>>> +	.priority = NF_IP_PRI_FIRST,
>> You're changing priorities here, NF_IP_PRI_RAW is not NF_IP_PRI_FIRST.
> 
> Aww.. that must have stemmed from ip6table_raw using _FIRST. Will fix.

This might actually be a bug. IPv4 uses:

	NF_IP_PRI_FIRST = INT_MIN,
	NF_IP_PRI_CONNTRACK_DEFRAG = -400,
	NF_IP_PRI_RAW = -300,
	NF_IP_PRI_SELINUX_FIRST = -225,
	NF_IP_PRI_CONNTRACK = -200,

while IPv6 uses:

	NF_IP6_PRI_FIRST = INT_MIN,
	NF_IP6_PRI_CONNTRACK_DEFRAG = -400,
	NF_IP6_PRI_SELINUX_FIRST = -225,
	NF_IP6_PRI_CONNTRACK = -200,

So we actually defragment packets in IPv4 even though they're
untracked. Perhaps Jozsef knows more details why we use
different priorities here.