ct_sync, kernel 2.6.10, NAT and masquerade

Following up some thorough testing and debugging, I finally got both (SNAT, DNAT) and MASQUERADe to work with ct_sync on a 2.6.10 kernel.

Apart from forgetting to disable TCP window tracking, there were some subtle mistakes in #ifdef/endif of the code that actually prevented whole sections from being built ;)

Debugging the problem however has forced me to update the ct_sync ethereal plugin (screenshot) to parse almost every bit within the ct_sync protocol.

Back to ct_sync

I've managed to get back to work on ct_sync again. The final steps towards full multi-master operation are underway. Apart from some changes to the protocol on the wire, there is a major reorganization of almost all involved data structures.

I'm deeply sorry for not having been able to continue at the pace that I wanted (and promised some customers), but there have been lots of issues that I couldn't push back and had to deal with them immediately.

ct_sync now fully modular

ct_sync is now able to run multiple instances on one node, allowing vrrp-like setups! Thanks go to http://svn.netfilter.org/netfilter/branches/netfilter-ha/linux-2.6-actact/

The next couple of weeks will be focusing on testing and real active-active setups with multiple masters. My brain is already smoking from all the synchronization issues ;)

Picked up working on ct_sync again

I've recently again picked up the work on ct_sync. The final goal ist to support real active-active fail-over setups. Before the real work on that particular issue can start, there are a number of prerequisites, like:

• multiple cluster instances on one node
• new sysfs-based configuration interface

Some more ct_sync fixes

The latest bug (endless loop) was caused by one of my last bugfixes. Apparently I introduced an endless loop into a linked list (the nat bysource hash).

Work starting on ct_sync active-active

The swiss company dremalab wants to sponsor me to work on an extension of ct_sync for active-active setups. More detailed news will appear very soon on the netfilter page and/or on this blog. Stay tuned.