[PATCH 0/2] TProxy fixes (2.6.30-rc3)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Patrick,

we extended a missing feature of the socket match that it can check the 'transparent' member of the socket's structure. The original behaviour was that all of the sockets matched if they weren't listening on the 0.0.0.0 IP address, even if they were unrelated to the TProxy, such as ssh or other servers.

The IP_TRANSPARENT socket option is always set for the sockets using the TProxy, thus the following patch lets matching only these:

  iptables ... -m socket --transparent ...

When I tested the new option, I found that NETFILTER_TPROXY depends on NF_CONNTRACK, which is unwanted, it works without it.

--
Attila
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux