On Tue, 13 Nov 2012, Pablo Neira Ayuso wrote: > On Mon, Nov 12, 2012 at 08:34:26PM +0100, Jozsef Kadlecsik wrote: > > > > What do you think about this? > > > > - add route change notification event to the net core > > - add --update-source-address flag to the MASQUERADE target > > - add a call for such events to the MASQUERADE target, when > > the flag is enabled > > > > The called function then can scan the conntrack table and for every entry > > which has got the update-source-address flag, can check whether the source > > IP address should be changed. Those entries are then deleted. > > It seems to me this can be implemented this from user-space. It would > require a new working mode for conntrackd that would: > > 1) subscribe to route events via rtnl and libmnl. > 2) get new interface address for some monitored address, also via rtnl. > 3) iterate over the table and remove those entries with outdated IP > address. > > All the infrastructure is ready, and it would not require any kernel > upgrade. What do you think about this approach? So far conntrackd implements conntrack replication. It could be extended with such functionality, yes. However, it'd be just good if MASQUERADE would not require an external component (i.e. userspace daemon) to work in all cases. Step 2 does indeed required? Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
