Re: Understanding conntrack: Delete and manual readd of same entry possible?

[Roman Fiedler <roman.fiedler@ait.ac.at>]

Pablo Neira Ayuso wrote:
> Roman Fiedler wrote:
>> Hi list,
>>
>> The failure to conduct a simple test with conntrack makes me believe,
>> that I misunderstood some part of the concept.
>>
>> The testcase ....
>
> I seem to have overlooked this email, sorry. You need this patch in
> order to make it work, I'm going to apply it to git.netfilter.org now so
> it will be available in the next release.

Thanks for the patch. When I've played with the same problem at home I've
guessed that it is something with sequence numbers and that setting tcp-liberal
in a netlink test application is a workaround for the DROP. But I did not
bring it to that point that I could create a clean patch because there were
still some loose ends. Perhaps someone could help me to fix some of these:

a) When conntrackd inserts the entries, does it set the liberal also? If yes,
is it correct, that a failover via conntrackd would disable sequence number
tracking for all existing entries?

b) Does the netlink api support sequence number parameters? If not, should it?

c) If the sequence numbers are not set by the conntrack utility, where do the
values in the kernel space come from? Are they all 0 or is it uninitialized
memory from user or kernel space?