Re: [libvirt] [PATCH v3] nwfilter: probe for inverted ctdir

My opinion is that the patch we should apply should be a simple patch that just removes use of --ctdir. According to the netfilter developer who responded to the thread on libvirt-users, it doesn't add any extra security not already provided by conntrack: https://www.redhat.com/archives/libvirt-users/2013-March/msg00121.html https://www.redhat.com/archives/libvirt-users/2013-March/msg00128.html Not being an expert on netfilter internals, I can't dispute his claim. Does anyone else have an opinion?