Re: xt_connlimit kernel 20070620

[Pablo Neira Ayuso <pablo@netfilter.org>]

Jan Engelhardt wrote:
> On Jun 20 2007 13:07, Pablo Neira Ayuso wrote:
>>> But it works with UDP too. This if() block looks merely like a
>>> watch-out-for-TCP exception. (And obviously, lacks SCTP/DCCP checking.)
>> I see, still I think that it would be worth to make it completely independent
>> of it.
> 
> UDP does not have a transition from ESTABLISHED -> TIME_WAIT, to begin with.

But the event API has the DESTROY transition. There are three kind of 
events: NEW, UPDATE and DESTROY. Just wait for DESTROY events to release 
the entry from the hashtable.

>>>> I think that it would be worth a
>>>> rework. Luke, use the connection tracking event API :)
>>> Where may I find examples?
>> Have a look at nf_conntrack_netlink.c look for the x_events() function. If
>> you have more questions on it. Let me know.
> 
> I think netlink is an overkill here. Well, at least I could not find
> something usable right away.

No, I didn't mean to use netlink. Just the connection tracking event 
API. See the example below.

> Something like
> 
> myfunction( ??? )
> {
> 	/* kill connlimit entry */
> }
> 
> __init init_module()
> {
> 	nf_register_whatever(ON_TCP_TRANSITION, myfunction);
> }
> 
> I just don't see any modules (matches, targets) that use events yet.
> Could you cook it up?

Does this give you a clue?

static int event(struct notifier_block *this, unsigned long events, void 
*ptr)
{
	struct nf_conn *ct = (struct nf_conn *)ptr;

	if (ct == &nf_conntrack_untracked)
		return NOTIFY_DONE;

	if (events & IPCT_NEW)
		printk("ct %p has been created\n", ct);
	if (events & IPCT_DESTROY)
		printk("ct %p has been destroy\n", ct);

	return NOTIFY_DONE;
}

static struct notifier_block ctnl_notifier = {
         .notifier_call  = event,
};

static int __init init(void)
{
	ret = nf_conntrack_register_notifier(&ctnl_notifier);
	...
}

...

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris