Re: [PATCH] Conntrack targets/matches work with nfconntrack

[Pablo Neira <pablo@eurodev.net>]

Yasuyuki KOZAKAI wrote:
> From: Pablo Neira <pablo@eurodev.net>
> Date: Sat, 02 Apr 2005 23:25:42 +0200
> 
> 
>>Hi,
>>
>>This patch makes work conntrack related matches and targets with both 
>>ip_conntrack and nf_conntrack (ipt_state, ipt_CONNMARK, ipt_connmark, 
>>ipt_NOTRACK, ipt_conntrack). Two comments about this:
>>
>>o I've slighty modified the ip_conntrack structure to make it look like 
>>nf_conntrack.
>>
>>-               u_int32_t ip;
>>+               union {
>>+                       u_int32_t ip;
>>+               } u3;
>>
>>o This patch adds some ifdef's. I understand that this isn't the more 
>>elegant way to do this but it's rather straight forward. I think that 
>>this solution is not that bad since ip_conntrack will dissapear some day 
>>together with those ifdef's.
> 
> 
> This causes compatibility problem (at least, libipt_conntrack.c of iptables).
> Then this patch is acceptable for me if we can easily fix it.

No problem, Rusty had the same problem when he modified the layout of 
ip_conntrack_tuple. Have a look at struct ip_conntrack_old_tuple in 
ipt_conntrack.h.

Anyway I don't see any obvious way to make work NAT code yet.

--
Pablo