Re: libnetfilter_conntrack question

[Phil Dibowitz <phil@ipom.com>]

[-- Attachment #1: Type: text/plain, Size: 1796 bytes --]

Pablo Neira Ayuso wrote:
> Phil Dibowitz wrote:
>> In the new API the flags bitmap I mentioned above is gone.
>>
>> What's the "right" way to determine stuff like (flags &
>> NFCT_COUNTERS_ORIG)?
>> It used to get passed into the callback in the old API, but no longer
>> does.
> 
> There is a nfct_attr_is_set(...) function to check if an attribute is
> set or not.

Ah. Perfect. Thanks.

One other question - I noticed that I can't seem to delete ICMP states. This
is true both from my own code, as well as from conntrack(8):

[phil@rider libnetfilter_conntrack]$ sudo grep icmp /proc/net/ip_conntrack
icmp     1 29 src=10.1.1.2 dst=209.40.128.125 type=8 code=0 id=43603
[UNREPLIED] src=209.40.128.125 dst=10.1.1.2 type=0 code=0 id=43603 use=1

[phil@rider libnetfilter_conntrack]$ sudo conntrack -D conntrack  -s
10.1.1.2 -d 209.40.128.125 -p icmp --icmp-type 8 --icmp-code 0
NFNETLINK answers: No such file or directory
Operation failed: such conntrack doesn't exist

I get the same thing either way - that the conntrack doesn't exist. I can
delete TCP and UDP just fine, but not ICMP. And just for clarity, yes, I'm
attempting to delete it before it expires (this is easy to check by keeping
iptstate running in a window).

Am I doing something wrong, or can you not delete ICMP states?

Thanks!
-- 
Phil Dibowitz                             phil@ipom.com
Open Source software and tech docs        Insanity Palace of Metallica
http://www.phildev.net/                   http://www.ipom.com/

"Never write it in C if you can do it in 'awk';
 Never do it in 'awk' if 'sed' can handle it;
 Never use 'sed' when 'tr' can do the job;
 Never invoke 'tr' when 'cat' is sufficient;
 Avoid using 'cat' whenever possible" -- Taylor's Laws of Programming



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]