Daniel wrote:
hi, all
We all know event IPCT_NEW is issued whenever conntrack is confirmed,
then how about issueing a IPCT_INIT event in init_conntrack()?
IPCT_INIT indicates that one IP is trying to create a connection, maybe
we can catch these kind of events, do some analyzation work, and block
the evil *attempting* packet(this will prevent conntrack being confirmed).
Is this make any sense?
That wouldn't work since the connection is going to be confirmed
before you get a chance to do something. On SMP it might work,
but would be racy. In general ctnetlink events relate to the
conntrack table, so we don't want to send events for connections
that are not confirmed.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
