Re: 2.6.12: connection tracking broken?

[Bart De Schuymer <bdschuym@pandora.be>]

Op di, 21-06-2005 te 01:22 +0200, schreef Patrick McHardy:
> This seems to be a really bad idea, for a single match that violates
> layering we need to deal with this inconsistency. It's not just the
> conntrack reference, with IPsec the packet passed to the defered hooks
> is totally different from when it was still inside IP, which for example
> breaks the policy match.

I agree it is annoying.

> > Trust me, people will complain if they can no longer use the physdev
> > match for routed packets.
> 
> I'm sure they will, now that they got used to it. Why can't people
> match on the bridge port inside ebtables and only match on the device
> within iptables? Is there a case that can't be handled this way?

ebtables doesn't have all the targets/matches that iptables has.
Perhaps a rule structure using marking can always be used so that the
ACCEPT/DROP can be deferred until inside ebtables, I don't know if that
will always be possible though.

Deferring the hooks makes the bridge-nf code alot more complicated, so I
would be glad to get rid of it if it is the right thing to do. But
backwards compatibility can't be maintained and I'd be surprised if
every ruleset that now works will still be possible using an
iptables/ebtables scheme.
It has worked fine in the past and I see no reason why to stop making it
work now because of some recently found and unrelated referencing
problem.
Of course, if the netfilter people decide it should be removed, then so
be it.

cheers,
Bart