Re: [PATCH] new match extension `flow'

[Pablo Neira <pablo@eurodev.net>]

Hi Josh,

Josh Samuelson wrote:

>You'll have to excuse my newness to the netfilter-devel scene and the
>list in general.  Thank you for pointing out the thread on the connection
>tracking events patch.  I had no idea work was being done there.
>Initial impression: Slick!
>
>I took your recommendations and changed the patch to use the connection
>tracking events API.  I also altered the flow match module to track
>the number of connections based on a network/mask option if one is
>specified.
>
>The kernel patch can only be applied after your CTE patch.  It should
>patch fine on 2.6.9, but 2.6.10-rc1 will reject a hunk for
>net/ipv4/netfilter/Kconfig because I added the lines necessary for
>IP_NF_CONNTRACK_EVENTS; easy enough to fix by hand though.
>
>The iptables patch should apply fine to vanilla iptables-1.2.11.
>  
>

nice work!

>I've only done some initial testing with this thus far: one machine
>routing through a patched machine.  Hopefully here in the next
>few days I can put this on a machine that routes a few hundred
>nodes to put some more load on it for testing purposes.
>  
>

please, don't forget that we are still discussing the event API. As this 
new match goes on top of it, we can hold this patch until the event API 
is pushed forward. Then we'll go back this point.

Some comments:

>diff -Pru linux-2.6.9/include/linux/netfilter_ipv4/ip_cte_flow.h linux-2.6.9-flow/include/linux/netfilter_ipv4/ip_cte_flow.h
>--- linux-2.6.9/include/linux/netfilter_ipv4/ip_cte_flow.h	1969-12-31 18:00:00.000000000 -0600
>+++ linux-2.6.9-flow/include/linux/netfilter_ipv4/ip_cte_flow.h	2004-11-03 19:10:13.000000000 -0600
>  
>

I see two possibilities here:

a) move ip_cte_flow.[h|c] to ipt_flow.[h|c], matches always fit in a file.
b) rename ip_cte_flow to ip_conntrack_flow_stats, this could be a module 
which generates stats about current connections going through the firewall.

I need to give more spins to this issue.

Any comments?

Pablo