Hrmm... I've looked over the recent patch, but I'm not certain how to implement this 'and' logic "if it's in list A, but not in list B".. etc.
If you wanted to see if a packet was transitioning from NEW to ESTABLISHED I think it would be as simple as something like the following:
iptables -t filter -A FORWARD -i $INet -o $LAN -d $INet_IP -m recent --rcheck --name recent_NEW -m recent ! --rcheck --name recent_ESTABLISHED -j Transition_to_ESTABLISHED
I'm not sure about the placement of the "!" on the line, you might have to play with it a bit to make sure that the syntax is correct. Anyone have any input here?
There must be some place in the connection tracking code where a simple log can be placed. I'm not that familiar with the internals, but it would seem that just before updating the state, you could just printk a log. Am I way off here?
I'm sure there is a place in the kernel code that this could be put, though I don't know as if many people would want such a thing. It might be able to be there and something that is off by default and then turned on via /proc.
Grant. . . .
