Re: How to register conntrack notifier

[Pablo Neira Ayuso <pablo@netfilter.org>]

Luca Pesce wrote:
> Hi Pablo,
>    I was looking at conntrack events callbacks and conntrack tools too.
> As you said in your mail, only one callback can be registered, so if
> nf_conntrack_netlink module is loaded, no other modules can register a
> callback for events.
> 
> If I correctly undertand the code, it seems that in the past kernels
> this limitation was not there.

Indeed. This limitation was introduced recently

> For example, 2.6.21.5 version had a
> notifier chain declared in nf_conntrack_ecache.c:
> 
> ATOMIC_NOTIFIER_HEAD(nf_conntrack_chain);
> 
> and nf_conntrack_register_notifier() simply adds an entry (callback
> block) to the chain, so many callbacks could be registered for
> conntrack events. Am I right?

Yes.

> Why has this been changed nowadays?

Because the notifier chain added too much overhead for the only single 
client (nf_conntrack_netlink) in the kernel code.