Trying to make 2.6.x IPsec and conntrack/nat work

Spent some time thinking about how to possibly solve the long standing problem with conntrack/NAT and the 2.6.x in-kernel AH/ESP implementation.
The recent discussion on netfilter-devel was quite productive, although most of my ideas turned out to be without technical possibility :(
For example, iptables cannot attach the same CHAIN to multiple HOOKS. That would be so neat. Would somebody remind me that that has to go into pkttables?
Anyway, I've now written a surprisingly small (but still ugly) patch that should do about 60% of the solution upon which we agreed on the mailing-list.
Unfortunately, I don't have the time to set up a full IPsec test bed right now, so I have to rely on others to test it..

Ulogd is becoming a flow accounting subsystem

Some nice Russian guy wrote a patch to add BSD like ipacct flow accounting to ulogd. This is something I had on my wish list for quite some time.

He has written an OUTPUT plugin that does all the flow accounting and file-writing itself. However, I have an idea of how this could be implemented in a more generic way: Implement flow accounting as interpreter, and return a pointer to a struct flowinfovia a new ulog_iret_t. This way any output plugin could reference flow information for the current flow.

Why do people have to make winter holidays?

I tried to get a train reservation on Friday/Saturday between Berlin and Nuernberg. All the trains, even the night trains (sleeper trains) on Friday or Saturday morning are fully booked out.

Apparently winter holidays in Berlin are starting and everybody is heading south to Bavaria and Austria for winter 'sports'. Kind of annoying that you cannot even get a single ticket five days in advance.

More work on the fail-over code

Currently Astaro is paying me for my development on the netfilter conntrack fail-over code. That's what I'm supposed to be working on, at the least... I should stop reading my email in the morning, because otherwise my whole day will be filled with other stuff that just results from reading emails.

Anyway, the fail-over has been progressing, slowly but steadily. I should expect some working code any day now.

Thanks again to [ /linux/netfilter | permanent link ]