On Tue, Aug 27, 2013 at 10:35:56AM +0200, Jesper Dangaard Brouer wrote: > On Tue, 27 Aug 2013, Patrick McHardy wrote: > > >Since the SYN proxy can't know the options the server supports, they have > >to be specified as parameters to the SYNPROXY target. The assumption is that > >these options are constant as long as you don't change settings on the > >server. > > Future extention idea: Perhaps we could auto detect the options the > server supports, after the first connection have been created? > I know this is problematic/difficult for the iptables framework, > because it would require the module to keep an internal dynamic > state, which iptables module does not handle well (due to how the > entires ruleset is reloaded on rule changes). The main reason why I didn't add this is since it assumes you have a single rule per destination. That assumption can't be made, so you'd have to maintain a table of options per destination. I'll add the synconf tool to generate rules based on what the server actually supports to the iptables repository once this has been merged. > Guess, the easiest thing to implement, would be to give a warning, > if the options (the server supports) does not match the modules config. Yes, that could be done. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
