[PATCH] Fix wrong order in event notification

[Pablo Neira <pablo@eurodev.net>]

[-- Attachment #1: Type: text/plain, Size: 407 bytes --]

The following sequence is displayed during events dumping of an ICMP 
connection:

[NEW]
[DESTROY]
[UPDATE]

This happens because the event IPCT_DESTROY is delivered in 
death_by_timeout, that is called from the icmp protocol helper 
(ct->timeout.function) once we see the reply.

To fix this, I propose to move this event to destroy_conntrack instead.

Signed-off-by: Pablo Neira Ayuso <pablo@eurodev.net>

[-- Attachment #2: 03destroy-event.patch --]
[-- Type: text/x-patch, Size: 849 bytes --]

Index: netfilter-2.6.14/net/ipv4/netfilter/ip_conntrack_core.c
===================================================================
--- netfilter-2.6.14.orig/net/ipv4/netfilter/ip_conntrack_core.c	2005-08-03 16:30:26.000000000 +0200
+++ netfilter-2.6.14/net/ipv4/netfilter/ip_conntrack_core.c	2005-08-03 16:32:30.000000000 +0200
@@ -327,6 +327,7 @@
 	IP_NF_ASSERT(atomic_read(&nfct->use) == 0);
 	IP_NF_ASSERT(!timer_pending(&ct->timeout));
 
+	ip_conntrack_event(IPCT_DESTROY, ct);
 	set_bit(IPS_DYING_BIT, &ct->status);
 
 	/* To make sure we don't get any weird locking issues here:
@@ -366,7 +367,6 @@
 {
 	struct ip_conntrack *ct = (void *)ul_conntrack;
 
-	ip_conntrack_event(IPCT_DESTROY, ct);
 	write_lock_bh(&ip_conntrack_lock);
 	/* Inside lock so preempt is disabled on module removal path.
 	 * Otherwise we can get spurious warnings. */