Le 26/04/2019 à 21:25, Pablo Neira Ayuso a écrit : > On Thu, Apr 25, 2019 at 05:41:45PM +0200, Nicolas Dichtel wrote: >> Le 25/04/2019 à 12:07, Nicolas Dichtel a écrit : >> [snip] >>> In fact, the conntrack tool set by default the family to AF_INET and forbid >>> to >>> set the family to something else (the '-f' option is not allowed for the >>> command >>> 'flush'). >> >> 'conntrack -D -f ipv6' will do the job, but this is still a regression. > > You mean, before this patch, flush was ignoring the family, and after > Kristian's patch, it forces you to use NFPROTO_UNSPEC to achieve the > same thing, right? > Before the patch, flush was ignoring the family, and after the patch, the flush takes care of the family. The conntrack tool has always set the family to AF_INET by default, thus, since this patch, only ipv4 conntracks are flushed with 'conntrack -F': https://git.netfilter.org/conntrack-tools/tree/src/conntrack.c#n2565 https://git.netfilter.org/conntrack-tools/tree/src/conntrack.c#n2796
Regards, Nicolas
