On Mon, 4 Aug 2008, Al Viro wrote:
quoted text > On Mon, Aug 04, 2008 at 11:16:07PM +0200, Krzysztof Oledzki wrote:
>
>> Solves partially: no more WARNING, however entries are still missing &
>> duplicated:
>>
>> # sysctl -a 2>/dev/null|grep net.netfilter
>> net.netfilter.nf_conntrack_generic_timeout =3D 600
>> net.netfilter.nf_conntrack_acct =3D 1
>> net.netfilter.nf_conntrack_generic_timeout =3D 600
>> net.netfilter.nf_conntrack_acct =3D 1
>
> Very interesting. Could you see at which point duplicates appear? I.e.
> in which sequence do you get registrations, at least on the level of "thi=
s
quoted text > module is loaded first, no duplicates, this one comes after, etc."
All I need to do is to load a single "nf_conntrack" module.
quoted text > =09... ah, hell. I see what's going on. The trouble is in
> nf_conntrack_standalone; you get a table that has _both_ net.netfilter.* =
and
quoted text > net.nf_conntrack_max, which means that it's attached to unified tree at
> net; if we already have something with net.netfilter, you've got trouble =
-
quoted text > which entry net.netfilter will come from?
Indeed.
quoted text > _All_ this crap comes from lousy historical API; it's too much for this
> cycle, but for .28 I'm going to clean that mess up. For now, split that
> table in two and register them separately. I.e. register nf_ct_sysctl_ta=
ble[]
quoted text > at nf_net_netfilter_sysctl_path *and* remove the "netfilter" entry from
> nf_ct_netfilter_table[].
Will do. Thanks.
quoted text > I'm really going down right now; will follow up after I get some sleep...
Right. I'll try to prepare and test your ideas at that time. Thank you=20
again.
Best regards,
=09=09=09=09Krzysztof Ol=EAdzki
