netfilter: nf_conntrack: add support for "conntrack zones"

Browse source

Normally, each connection needs a unique identity. Conntrack zones allow
to specify a numerical zone using the CT target, connections in different
zones can use the same identity.

Example:

iptables -t raw -A PREROUTING -i veth0 -j CT --zone 1
iptables -t raw -A OUTPUT -o veth1 -j CT --zone 1

Signed-off-by: Patrick McHardy <kaber@trash.net>

...

This commit is contained in:

Patrick McHardy 2010-02-15 18:13:33 +01:00

parent 8fea97ec17

commit 5d0aa2ccd4

25 changed files with 236 additions and 85 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

include/linux/netfilter/xt_CT.h

View file

3

include/net/ip.h

View file

3

include/net/ipv6.h

View file

5

include/net/netfilter/nf_conntrack.h

View file

3

include/net/netfilter/nf_conntrack_core.h

View file

9

include/net/netfilter/nf_conntrack_expect.h

View file

2

include/net/netfilter/nf_conntrack_extend.h

View file

23

include/net/netfilter/nf_conntrack_zones.h

View file