Re: [PATCH nft 0/2] src: add conntrack information to trace monitor mode

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jul 07, 2025 at 09:28:29PM +0200, Florian Westphal wrote:
> diff --git a/src/trace.c b/src/trace.c
> index b270951025b8..b3b2c8fdf1b9 100644
> --- a/src/trace.c
> +++ b/src/trace.c
> @@ -264,7 +264,7 @@ static struct expr *trace_alloc_list(const struct datatype *dtype,
>         for (i = 0; i < 32; i++) {
>                 uint32_t bitv = v & (1 << i);
> 
> -               if (bitv == 0)
> +               if (bitv == 0 || i == IPS_UNTRACKED_BIT)
>                         continue;
> 
> and remove the IPS_UNTRACKED_BIT from the symbol table.
> 
> Then followup with a kernel patch that removes IPS_UNTRACKED_BIT before
> dumping ct->status.
> 
> Does that sound ok?

Yes, let's keep it back until there is a clear use-case for this,
either not exposing it or promoting it as a first class citizen.

> If so, I'll apply the first patch in this series before resending 2/2.

Thanks.