Hi Pablo, I was looking at conntrack events callbacks and conntrack tools too. As you said in your mail, only one callback can be registered, so if nf_conntrack_netlink module is loaded, no other modules can register a callback for events. If I correctly undertand the code, it seems that in the past kernels this limitation was not there. For example, 2.6.21.5 version had a notifier chain declared in nf_conntrack_ecache.c: ATOMIC_NOTIFIER_HEAD(nf_conntrack_chain); and nf_conntrack_register_notifier() simply adds an entry (callback block) to the chain, so many callbacks could be registered for conntrack events. Am I right? Why has this been changed nowadays? Thanks! Luca On Wed, Oct 28, 2009 at 1:14 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > Nils Rennebarth wrote: >> Hi, >> >> The help text for NF_CONNTRACK_EVENTS reads: >> If this option is enabled, the connection tracking code will >> provide a notifier chain that can be used by other kernel code >> to get notified about changes in the connection tracking state. >> which sounds just like what I need: I want to execute a callback >> whenever a conntrack gets destroyed. However studying >> nf_conntrack_netlink.c, nf_conntrack_ecache.c and related header files >> for quite a while now, i am still unable to figure out how to do that. >> >> Can someone enlighten me? > > You have to register a structure nf_ct_event_notifier with the callback > function, you have to look at nf_conntrack_ecache.c and > nf_conntrack_netlink.c. There one problem though since you can only > register one callback and that one is usually used by nf_conntrack_netlink.c > > You can also catch events from user-space by means of > libnetfilter_conntrack, have a look at utils/, it includes some examples. > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
