From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: Re: [NETFILTER]: xt_conntrack: add port and direction matching Date: Mon, 21 Jan 2008 02:18:53 +0100 Message-ID: <4793F2FD.7040500@netfilter.org> References: <477E487D.8000901@trash.net> <478C573D.2060401@trash.net> <478CBF6D.3060309@trash.net> <478F5D92.3040404@netfilter.org> <479345F0.8000009@trash.net> <4793F1F0.2080403@netfilter.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Patrick McHardy , Netfilter Developer Mailing List To: Jan Engelhardt Return-path: Received: from mail.us.es ([193.147.175.20]:33779 "EHLO us.es" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756272AbYAUBTF (ORCPT ); Sun, 20 Jan 2008 20:19:05 -0500 In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: Jan Engelhardt wrote: > On Jan 21 2008 02:14, Pablo Neira Ayuso wrote: >> BTW, it would be great if we add support for layer 4 protocol state >> matching, e.g. match TCP established. We can use this together with the >> target that would mark certain events as volatile, e.g. >> >> iptables -A 192.168.0.0/24 -m conntrack ! --tcp-state ESTABLISHED -j >> VOLATILE > > And what's xt_VOLATILE do? (Was it hidden in your recent > xt_CONNTRACK submission?) Indeed. Just set the IPCT_VOLATILE flag to tell ctnetlink to skip that event. It would be a very simple target. I don't know if VOLATILE would be a nice name, perhaps CTNETLINK. -- "Los honestos son inadaptados sociales" -- Les Luthiers