From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Baptiste Jonglez <baptiste@bitsofnetworks.org>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: [WireGuard] Is nf_conntrack really needed?
Date: Tue, 22 Nov 2016 17:08:02 +0100 [thread overview]
Message-ID: <CAHmME9rCpUtxsCmKrdAXBu466iLrTajQt5goc6NvtUU_5QbjHQ@mail.gmail.com> (raw)
In-Reply-To: <20161122121748.GF20343@tuxmachine.polynome.dn42>
Hey,
In fact, it's not needed if it's not needed. How to explain this
apparent tautology?
If conntracking is compiled into the kernel, then for ICMP, I need to
ask conntracking if it's possibly mangled the src IP of the packet
before giving it to the wireguard device. If conntracking isn't
compiled into the kernel, then there's nobody to ask and probably the
packet wasn't mangled, in which case, I don't need to do anything. So,
the following patch makes conntrack optional:
https://git.zx2c4.com/WireGuard/commit/?id=c90fba009d70eedac614d77ad3494ed450b2995e
This will be included in the next snapshot.
Jason
prev parent reply other threads:[~2016-11-22 16:04 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-22 12:17 Baptiste Jonglez
2016-11-22 16:08 ` Jason A. Donenfeld [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHmME9rCpUtxsCmKrdAXBu466iLrTajQt5goc6NvtUU_5QbjHQ@mail.gmail.com \
--to=jason@zx2c4.com \
--cc=baptiste@bitsofnetworks.org \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).