Paul Blakey <pa...@mellanox.com> wrote: > + /* The conntrack module expects to be working at L3. */
It also expects that IP stack has validated ip(v6) headers and has pulled the ip header into linear area. What are your plans wrt. IP fragments? AFAICS right now they will not match which means they won't be NATed either. Is that ok? For offloading connection tracking and NAT, I think the flowtable infrastructure is much better: it will allow any device to push packets that it can't deal with (fragmented, too large mtu, changed route, etc) to the software path and conntrack will be aware its dealing with a flow that was offloaded, e.g. it will elide sequence number checks. For connection tracking on L2, Pablo recently added conntrack for classic bridge (without the 'call-iptables' infrastructure), see net/bridge/netfilter/nf_conntrack_bridge.c (especially the defrag/refrag and header validation its doing). I suspect parts of that are also needed in the conntrack action (you might be able to reuse/export some of the functionality I think).
