Jan Engelhardt wrote:
xt_conntrack for example has a nicer effect: once you add a rule that
contains it, it will load nf_conntrack_ipv{4,6}, which in turn causes
Netfilter to start tracking in the first place.
So along the lines, xt_connbytes could pin a module (or perhaps
something more light-weight) to ultimately signify
"forced-activation"/"deactivation-impossible", much like you cannot
remove nf_conntrack while an xt_conntrack-using rule is in place.
It doesn't have to be forced IMO, but yes, the automatic enabling
should be similar to what xt_conntrack does.
Then only one thing remains. As for nf_conntrack, once it is loaded,
it picks up already-running connections (and loses them as soon
as you rmmod it). This is not the case with accounting as far as I
have observed yesterday - only new connections get to have (or
not to have) an acct structure; existing ones are not modified
or picked up like conntrack does.
Thats not possible using ct_extend.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
