Subject: Re: [RFC] SECMARK 1.1

From: Patrick McHardy <[email-masked]>
Date: Sun, 14 May 2006 20:37:36 +0200

James Morris wrote:
> @@ -135,6 +175,9 @@ static int __init xt_secmark_init(void)
>  {
>  	int err;
>  
> +	if (tracking_enabled())
> +		need_conntrack();
> +

This will load the conntrack modules even if the track flag is not set.
Wouldn't it be better to put everything related to connection marking
in the CONNSECMARK target?