diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2011-02-01 16:06:30 +0100 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2011-02-01 16:06:30 +0100 |
| commit | 3db7e93d3308fb882884b9f024235d6fbf542034 (patch) | |
| tree | 6488a45704107f77645774c85d67511b7a73fed1 /include | |
| parent | 9d0db8b6b1da9e3d4c696ef29449700c58d589db (diff) | |
| download | blackbird-op-linux-3db7e93d3308fb882884b9f024235d6fbf542034.tar.gz blackbird-op-linux-3db7e93d3308fb882884b9f024235d6fbf542034.zip | |
netfilter: ecache: always set events bits, filter them later
For the following rule:
iptables -I PREROUTING -t raw -j CT --ctevents assured
The event delivered looks like the following:
[UPDATE] tcp 6 src=192.168.0.2 dst=192.168.1.2 sport=37041 dport=80 src=192.168.1.2 dst=192.168.1.100 sport=80 dport=37041 [ASSURED]
Note that the TCP protocol state is not included. For that reason
the CT event filtering is not very useful for conntrackd.
To resolve this issue, instead of conditionally setting the CT events
bits based on the ctmask, we always set them and perform the filtering
in the late stage, just before the delivery.
Thus, the event delivered looks like the following:
[UPDATE] tcp 6 432000 ESTABLISHED src=192.168.0.2 dst=192.168.1.2 sport=37041 dport=80 src=192.168.1.2 dst=192.168.1.100 sport=80 dport=37041 [ASSURED]
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/netfilter/nf_conntrack_ecache.h | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h index 96ba5f7dcab6..349cefedc9f3 100644 --- a/include/net/netfilter/nf_conntrack_ecache.h +++ b/include/net/netfilter/nf_conntrack_ecache.h @@ -77,9 +77,6 @@ nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct) if (e == NULL) return; - if (!(e->ctmask & (1 << event))) - return; - set_bit(event, &e->cache); } |
