Hi,
Rui Sousa wrote:
Hi all,
Under some conditions it's possible to send a conntrack netlink event to
userspace which is missing the TCP connection state
(CDA_PROTOINFO_TCP_STATE) even though it is well defined.
This one liner should fix the problem. What do you think?
I see, I had to look at the code to find the condition that you mention,
that it is the following:
if (!test_bit(IPS_ASSURED_BIT, &ct->status)
&& (old_state == TCP_CONNTRACK_SYN_RECV
|| old_state == TCP_CONNTRACK_ESTABLISHED)
&& new_state == TCP_CONNTRACK_ESTABLISHED)
/* Set ASSURED if we see see valid ack in ESTABLISHED
after SYN_RECV or a valid answer for a picked up
connection. */
However, the policy is to include the TCP protocol state iff it has changed.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
