Am 01.02.2011 13:05, schrieb Pablo Neira Ayuso: > For the following rule: > > iptables -I PREROUTING -t raw -j CT --ctevents assured > > The event delivered looks like the following: > > [UPDATE] tcp 6 src=192.168.0.2 dst=192.168.1.2 sport=37041 dport=80 src=192.168.1.2 dst=192.168.1.100 sport=80 dport=37041 [ASSURED] > > Note that the TCP protocol state is not included. For that reason > the CT event filtering is not very useful for conntrackd. > > To resolve this issue, instead of conditionally setting the CT events > bits based on the ctmask, we always set them and perform the filtering > in the late stage, just before the delivery. > > Thus, the event delivered looks like the following: > > [UPDATE] tcp 6 432000 ESTABLISHED src=192.168.0.2 dst=192.168.1.2 sport=37041 dport=80 src=192.168.1.2 dst=192.168.1.100 sport=80 dport=37041 [ASSURED] > Looks good to me, applied, thanks. Do you want me to push this one to -stable as well? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
