xt_connlimit 20070628 kernel
kaber at trash.net
Wed Jul 4 16:52:17 CEST 2007
Jan Engelhardt wrote:
> On Jul 3 2007 13:34, Patrick McHardy wrote:
>>>>Use the conntrack tuple if one is available, otherwise use
>>>So you are saying I should use...
>>> nf_ct_get_tuple(skb, 0, 0, match->family, match->proto, &tuple,
>>> what_l3, what_l4);
>>>at the top of count_them() and get rid of the nf_ct_get() in connlimit_match?
>>You could do both, if the tuple is already derived there is no need
>>to repeat that work.
> So the netfilter connection tracking system itself does nf_ct_get_tuple() at
> some point?
Right, when the packet hits connection tracking.
More information about the netfilter-devel