Re: [PATCH 10/10][CONNTRACK] introduce the pickup flag to take over connections

[Pablo Neira Ayuso <pablo@netfilter.org>]

Jozsef Kadlecsik wrote:
> Hi Pablo,
> 
> On Fri, 7 Jul 2006, Pablo Neira Ayuso wrote:
> 
> 
>>This patch introduces a new flag called IPS_PICKUP that forces the
>>protocol handler to pick up the required information in order to ensure
>>that the connection will reach a successful state. Currently, the only
>>client is the TCP protocol helper.
>>
>>More arguments conntrackd or whatever failover solution need this.
>>
>>@Jozsef: You know better TCP sequence tracking in-deep details, can you
>>see any problem with this?
> 
> Nothing against it as I see. But I'd regard it as a preliminary step
> toward creating conntrack entries by conntrackd/failover: the missing bits
> are the flags (SACK and WSCALE) and the window scale factor. We assume
> SACK is on (which thus don't hurt), but disabled window scaling can really
> bite if it's actually on.

Interesting, since the scale factor is only advertised in the SYN+ACK 
packet, we need a patch to introduce a new ctnetlink attribute that 
contains the scale factor. I think that should be enough.

Thanks for the clue.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris