Re: [PATCH 1/2] flow match

[Pablo Neira <pablo@eurodev.net>]

Josh Samuelson wrote:
> Greetings all,
> 
> This patch requires Pablo Neira's conntrack event API patch.  It's been
> many months since I've posted, but I've been tracking the changes that
> have been made and making the necessary revisions to the code.
> Thanks Pablo for the heads-up on my silly misuses of the locks,
> hopefully I've got those cleared up. :)  I also added the ability to
> track new and established flows to the module.  Also I used
> Patrick McHardy's iterative state method of looping over the hashes
> for the proc files.  I figured it was high time to submit it again.
> 
> Quoting the man page for the match:
> 
>   This module allows you to match a packet when the specified number of
>   known protocol connections is exceeded.  The matches can be made
>   against generic IP, ICMP, TCP or UDP flow counters.  This match can be
>   used in all tables but raw.

Looks fine, I didn't have time yet to review this stuff in deep though, 
I'm moving to another appartament.

This stuff clearly supersedes `connlimit' that is a bit raw and very 
"limited".

@Patrick: Do you agree to add this to pom-ng?

--
Pablo