[CTNETLINK] dump counters iif connection ended or counters filled up This patch makes ctnetlink to dump counters iif connection reaches the destroy state or altenatively if counters filled up. Signed-off-by: Pablo Neira Ayuso Index: net-2.6/net/ipv4/netfilter/ip_conntrack_netlink.c =================================================================== --- net-2.6.orig/net/ipv4/netfilter/ip_conntrack_netlink.c 2006-07-06 19:52:54.000000000 +0200 +++ net-2.6/net/ipv4/netfilter/ip_conntrack_netlink.c 2006-07-06 19:54:00.000000000 +0200 @@ -381,8 +381,10 @@ static int ctnetlink_conntrack_event(str && ctnetlink_dump_helpinfo(skb, ct) < 0) goto nfattr_failure; - if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 || - ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0) + /* this connection has died or counters wrapped around */ + if ((events & IPCT_DESTROY || events & IPCT_COUNTER_FILLING) + && (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 || + ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)) goto nfattr_failure; if (events & IPCT_MARK Index: net-2.6/net/netfilter/nf_conntrack_netlink.c =================================================================== --- net-2.6.orig/net/netfilter/nf_conntrack_netlink.c 2006-07-06 19:54:02.000000000 +0200 +++ net-2.6/net/netfilter/nf_conntrack_netlink.c 2006-07-06 19:54:35.000000000 +0200 @@ -391,8 +391,10 @@ static int ctnetlink_conntrack_event(str && ctnetlink_dump_helpinfo(skb, ct) < 0) goto nfattr_failure; - if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 || - ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0) + /* this connection has died or counters wrapped around */ + if ((events & IPCT_DESTROY || events & IPCT_COUNTER_FILLING) + && (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 || + ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)) goto nfattr_failure; if (events & IPCT_MARK