From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Cc: Florian Westphal <fw@strlen.de>,
netdev@vger.kernel.org, netfilter-devel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH nf] netfilter: restore default behavior for nf_conntrack_events
Date: Wed, 26 Jun 2024 13:41:22 +0200 [thread overview]
Message-ID: <Znv-YuDbgwk_1gOX@calendula> (raw)
In-Reply-To: <20240604135438.2613064-1-nicolas.dichtel@6wind.com>
Hi Nicolas,
On Tue, Jun 04, 2024 at 03:54:38PM +0200, Nicolas Dichtel wrote:
> Since the below commit, there are regressions for legacy setups:
> 1/ conntracks are created while there are no listener
> 2/ a listener starts and dumps all conntracks to get the current state
> 3/ conntracks deleted before the listener has started are not advertised
>
> This is problematic in containers, where conntracks could be created early.
> This sysctl is part of unsafe sysctl and could not be changed easily in
> some environments.
>
> Let's switch back to the legacy behavior.
Maybe it is possible to annotate destroy events in a percpu area if
the conntrack extension is not available. This code used to follow
such approach time ago.
next prev parent reply other threads:[~2024-06-26 11:41 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-04 13:54 [PATCH nf] netfilter: restore default behavior for nf_conntrack_events Nicolas Dichtel
2024-06-05 8:55 ` Florian Westphal
2024-06-05 9:09 ` Nicolas Dichtel
2024-06-05 18:41 ` Pablo Neira Ayuso
2024-06-06 8:50 ` Nicolas Dichtel
2024-06-06 8:53 ` Florian Westphal
2024-06-06 13:07 ` Nicolas Dichtel
2024-06-26 11:41 ` Pablo Neira Ayuso [this message]
2024-07-03 7:37 ` Nicolas Dichtel
2024-07-15 14:19 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Znv-YuDbgwk_1gOX@calendula \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nicolas.dichtel@6wind.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.