]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: nfnetlink: re-enable conntrack expectation events
authorFlorian Westphal <fw@strlen.de>
Fri, 5 Aug 2022 08:59:57 +0000 (10:59 +0200)
committerFlorian Westphal <fw@strlen.de>
Thu, 11 Aug 2022 16:09:54 +0000 (18:09 +0200)
commit5424e22e4aba17d92df546a2b0490cc8aed498a4
treebfa2c94a9c15a9a35aa9e1e8ef42063d684eaf55
parent42317868a636d645a54e585e686b4bef5b5acd66
netfilter: nfnetlink: re-enable conntrack expectation events

To avoid allocation of the conntrack extension area when possible,
the default behaviour was changed to only allocate the event extension
if a userspace program is subscribed to a notification group.

Problem is that while 'conntrack -E' does enable the event allocation
behind the scenes, 'conntrack -E expect' does not: no expectation events
are delivered unless user sets
"net.netfilter.nf_conntrack_events" back to 1 (always on).

Fix the autodetection to also consider EXP type group.

We need to track the 6 event groups (3+3, new/update/destroy for events and
for expectations each) independently, else we'd disable events again
if an expectation group becomes empty while there is still an active
event group.

Fixes: 8ce46ceb3f06 ("netfilter: nfnetlink: allow to detect if ctnetlink listeners exist")
Reported-by: Yi Chen <yiche@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
include/net/netns/conntrack.h
net/netfilter/nfnetlink.c