Subject: Re: [PATCH 5/5] netfilter: xt_TEE: have cloned packet travel through Xtables too

From: Patrick McHardy <[email-masked]>
Date: Thu, 01 Apr 2010 12:37:28 +0200

Jan Engelhardt wrote:
> Since Xtables is now reentrant/nestable, the cloned packet can also go
> through Xtables and be subject to rules itself.

That sounds dangerous if conntrack isn't used to prevent loops.
Is that really useful? For filtering, you can simply apply the
rules before deciding to TEE the packet.