Re: [PATCH] conntrack event missing TCP protoinfo

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

Rui Sousa wrote:
> Hi all,
> 
> Under some conditions it's possible to send a conntrack netlink event to 
> userspace which is missing the TCP connection state 
> (CDA_PROTOINFO_TCP_STATE) even though it is well defined.
> This one liner should fix the problem. What do you think?

I see, I had to look at the code to find the condition that you mention, 
that it is the following:

if (!test_bit(IPS_ASSURED_BIT, &ct->status)
     && (old_state == TCP_CONNTRACK_SYN_RECV
         || old_state == TCP_CONNTRACK_ESTABLISHED)
     && new_state == TCP_CONNTRACK_ESTABLISHED)
        /* Set ASSURED if we see see valid ack in ESTABLISHED
           after SYN_RECV or a valid answer for a picked up
           connection. */

However, the policy is to include the TCP protocol state iff it has changed.