Subject: Re: [PATCH net-next v2] act_ct: prepare for stolen verdict coming from conntrack and nat engine

From: Simon Horman <[email-masked]>
Date: Fri, 5 Jul 2024 10:42:22 +0100

On Thu, Jul 04, 2024 at 01:29:20PM +0200, Florian Westphal wrote:
> At this time, conntrack either returns NF_ACCEPT or NF_DROP.
> To improve debuging it would be nice to be able to replace NF_DROP verdict

nit: debugging

     (I don't think there is a need to repost just because of this)

> with NF_DROP_REASON() helper,
> 
> This helper releases the skb instantly (so drop_monitor can pinpoint
> exact location) and returns NF_STOLEN.
> 
> Prepare call sites to deal with this before introducing such changes
> in conntrack and nat core.
> 
> Signed-off-by: Florian Westphal <[email-masked]>
> ---
>  No changes, v1 errounously targetted 'net' tree.

Reviewed-by: Simon Horman <[email-masked]>