Re: firewall + loadbalancer on the same machine

[Atif Ghaffar <aghaffar@xxxxxxxxxxxx>]

Roberto Nibali wrote:
> In all honesty, I can hardly believe that you want to go through that 
> hassle of patching any vendor kernel with a vanilla-diffed feature 
> outside the tree. 
Just patched SuSE 9.0 version (2.4.22.somthing) with one reject and
Whitebox Linux (Redhat Enterprise linux 3 based) with one reject.

The rejects from the RHEL 3.x (kernel 2.4.21-15.ELsmp patched with GFS 
support) patched with linux-2.4.20-ipvs-1.0.8-antefacto.patch gives just 
the following rejects (see below).  I'd say.. good work.
./kernel/ksyms.c.rej
***************
*** 127,132 ****
  EXPORT_SYMBOL(kmap_prot);
  EXPORT_SYMBOL(kmap_pte);
  #endif
  EXPORT_SYMBOL(buffermem_pages);
  EXPORT_SYMBOL(nr_free_pages);
  EXPORT_SYMBOL(page_cache_size);
--- 127,133 ----
  EXPORT_SYMBOL(kmap_prot);
  EXPORT_SYMBOL(kmap_pte);
  #endif
+
  EXPORT_SYMBOL(buffermem_pages);
  EXPORT_SYMBOL(nr_free_pages);
  EXPORT_SYMBOL(page_cache_size);


and

./net/ipv4/netfilter/ip_conntrack_core.c.rej
***************
*** 692,697 ****

        /* Mark clearly that it's not in the hash table. */
        conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list.next = NULL;

        WRITE_LOCK(&ip_conntrack_lock);
        /* Need finding and deleting of expected ONLY if we win race */
--- 692,698 ----

        /* Mark clearly that it's not in the hash table. */
        conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list.next = NULL;
+       conntrack->tuplehash[IP_CT_DIR_REPLY].list.next = NULL;

        WRITE_LOCK(&ip_conntrack_lock);
        /* Need finding and deleting of expected ONLY if we win race */