Re: netfilter hook/tuple question

Re: netfilter hook/tuple question

[Rusty Russell]

On Fri, 9 Jul 2010 05:08:52 am Huascar Tejeda wrote:
> Hello Rusty Russell,
> 
> I'm starting to learn about netfilter hooks programming and I have a small
> question. Is it possible to see the packets in my hook even if it already is
> in a tuple?

Hi Huascar,

   Sorry for the delayed response.  This question might have been better
directed at the netfilter-devel mailing list.

> My hook reads HTTP requests looking for QueryStrings. it's running in a
> linux gateway and I have these scenarios:
> 
>  - From a linux client: if I access google.com I can see the request for the
> first time, but since Linux re-uses source-port I don't see it again in my
> hook.
>  - From a windows client: it works very well cause windows always use
> different source-port so it is handled as a new connection every time.
> 
> Here is my code: http://codepad.org/T6SESSRg

AFAICT, this should work...  It's pretty simple.

Rusty.