Re: [PATCH 2/3][CONNTRACK] Introduce the pickup facilities to take over TCP connections

[Pablo Neira Ayuso <pablo@netfilter.org>]

Krzysztof Oledzki wrote:
> 
> On Mon, 21 Aug 2006, Pablo Neira Ayuso wrote:
> 
>> This patch introduces a new flag called IPS_PICKUP that forces the 
>> protocol handler to pick up the window of valid TCP packets. Moreover, 
>> four new attributes to inject the window scale factor and enable SACK 
>> are introduced.
>>
>> These new facilities provide the appropiate mechanisms to take over 
>> TCP connections in failover settings with TCP tracking enabled.
>>
> Are there any plans for active-active synchronization? This requires 
> online TCP SEQ sync or to keep connections in IPS_PICKUP state forever, 
> doesn't it?

Hm, you mean the active-active setting for conntrackd? The current 
architecture already supports it.

You seem to be confused with the IPS_PICKUP flag: this flag must be set 
for conntracks created from userspace via ctnetlink, thus the TCP window 
tracking knows that it has to take over the valid window of TCP 
sequences, once that happens this flag is unset.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris