Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vrf: T6603: conntrack ct_iface_map must only contain one entry for iifname/oifname #3883

Merged
merged 2 commits into from
Jul 30, 2024
Merged

vrf: T6603: conntrack ct_iface_map must only contain one entry for iifname/oifname #3883

merged 2 commits into from
Jul 30, 2024

Commits on Jul 26, 2024

  1. vrf: T6603: conntrack ct_iface_map must only contain one entry for ii… 

    …fname/oifname

When any of the following features NAT, NAT66 or Firewall is enabled, for every
VRF on the CLI we install one rule into nftables for conntrack:

    chain vrf_zones_ct_in {
            type filter hook prerouting priority raw; policy accept;
            counter packets 3113 bytes 32227 ct original zone set iifname map @ct_iface_map
            counter packets 8550 bytes 80739 ct original zone set iifname map @ct_iface_map
            counter packets 5644 bytes 67697 ct original zone set iifname map @ct_iface_map
    }

This is superfluous.
    @c-po
    c-po committed Jul 26, 2024
    Configuration menu
    Copy the full SHA
    d6e9824 View commit details
    Browse the repository at this point in the history

  2. vrf: T6603: improve code runtime when retrieving info from nftables v… 

    …rf zone
    @c-po
    c-po committed Jul 26, 2024
    Configuration menu
    Copy the full SHA
    31acb42 View commit details
    Browse the repository at this point in the history