Re: Warning when unloading the nf_conntack module (regression?)

[Al Viro <viro@ZenIV.linux.org.uk>]

On Mon, Aug 04, 2008 at 11:16:07PM +0200, Krzysztof Oledzki wrote:

> Solves partially: no more WARNING, however entries are still missing & 
> duplicated:
>
> # sysctl -a 2>/dev/null|grep net.netfilter
> net.netfilter.nf_conntrack_generic_timeout = 600
> net.netfilter.nf_conntrack_acct = 1
> net.netfilter.nf_conntrack_generic_timeout = 600
> net.netfilter.nf_conntrack_acct = 1

Very interesting.  Could you see at which point duplicates appear?  I.e.
in which sequence do you get registrations, at least on the level of "this
module is loaded first, no duplicates, this one comes after, etc."

	... ah, hell.  I see what's going on.  The trouble is in
nf_conntrack_standalone; you get a table that has _both_ net.netfilter.* and
net.nf_conntrack_max, which means that it's attached to unified tree at
net; if we already have something with net.netfilter, you've got trouble -
which entry net.netfilter will come from?

_All_ this crap comes from lousy historical API; it's too much for this
cycle, but for .28 I'm going to clean that mess up.  For now, split that
table in two and register them separately.  I.e. register nf_ct_sysctl_table[]
at nf_net_netfilter_sysctl_path *and* remove the "netfilter" entry from
nf_ct_netfilter_table[].

I'm really going down right now; will follow up after I get some sleep...