netfilter: ecache: always set events bits, filter them later
authorPablo Neira Ayuso <pablo@netfilter.org>
Tue, 1 Feb 2011 15:06:30 +0000 (16:06 +0100)
committerPatrick McHardy <kaber@trash.net>
Tue, 1 Feb 2011 15:06:30 +0000 (16:06 +0100)
commit3db7e93d3308fb882884b9f024235d6fbf542034
tree6488a45704107f77645774c85d67511b7a73fed1
parent9d0db8b6b1da9e3d4c696ef29449700c58d589db
netfilter: ecache: always set events bits, filter them later

For the following rule:

iptables -I PREROUTING -t raw -j CT --ctevents assured

The event delivered looks like the following:

 [UPDATE] tcp      6 src=192.168.0.2 dst=192.168.1.2 sport=37041 dport=80 src=192.168.1.2 dst=192.168.1.100 sport=80 dport=37041 [ASSURED]

Note that the TCP protocol state is not included. For that reason
the CT event filtering is not very useful for conntrackd.

To resolve this issue, instead of conditionally setting the CT events
bits based on the ctmask, we always set them and perform the filtering
in the late stage, just before the delivery.

Thus, the event delivered looks like the following:

 [UPDATE] tcp      6 432000 ESTABLISHED src=192.168.0.2 dst=192.168.1.2 sport=37041 dport=80 src=192.168.1.2 dst=192.168.1.100 sport=80 dport=37041 [ASSURED]

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
include/net/netfilter/nf_conntrack_ecache.h
net/netfilter/nf_conntrack_ecache.c