Hi Dave,
On 2009.04.30., at 18:39, David Miller wrote:
From: Laszlo Attila Toth <panther@xxxxxxxxxx>
Date: Thu, 30 Apr 2009 17:35:55 +0200
xt_socket can use connection tracking, and checks whether it is a
module.
Signed-off-by: Laszlo Attila Toth <panther@xxxxxxxxxx>
I don't understand why we want what this is doing....
Most of the time the source / destination addresses and ports of the
packet are enough to lookup the corresponding socket. With the SNAT
target this kind of lookup is broken. The socket match is in the
mangle table, before nat, thus it can see only the destination address
set by the SNAT target (this is the reply direction). If we want to
support SNAT, we need nf_conntrack. But this is optional, if
connection tracking is not in the kernel, the socket match will
compiled without it....
+ depends on !NF_CONNTRACK || NF_CONNTRACK
This means that if NF_CONNTRACK is modular, it won't allow
the xt_socket code to be built.
I checked that if NF_CONNTRACK is disabled, the socket match will be
allowed to be built either into a module, or into vmlinuz. If
NF_CONNTRACK is "y", it is exactly the same. If NF_CONNTRACK=m, the
socket match can only be a module.
However, all of this stuff should be buildable modular.
--
Attila--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
