[PATCH] [NETFILTER] ip_conntrack: Update event cache when status changes

[Harald Welte <laforge@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 3094 bytes --]

Hi Dave!

While preparing the first release of libnfnetlink,
libnfnetlink_conntrack and the "conntrack" userspace program, I found
out that some events are never generated within the kernel.  Please
apply the patch below, thans.


[NETFILTER] ip_conntrack: Update event cache when status changes

The GRE, SCTP and TCP protocol helpers did not call ip_conntrack_event_cache()
when updating ct->status.  This patch adds the respective calls.

Signed-off-by: Harald Welte <laforge@netfilter.org>

---
commit 1699521ab4e23ba4dd9f8bdd894393b8e109fe43
tree 2e0e4becf37fc85de0206eb7d381c3d849075ce8
parent 5a9087bd9bf78e3ca131a84a8eed06d6c31396dc
author Harald Welte <laforge@hanuman.de.gnumonks.org> Sat, 24 Sep 2005 20:47:41 +0200
committer Harald Welte <laforge@hanuman.de.gnumonks.org> Sat, 24 Sep 2005 20:47:41 +0200

 net/ipv4/netfilter/ip_conntrack_proto_gre.c  |    1 +
 net/ipv4/netfilter/ip_conntrack_proto_sctp.c |    1 +
 net/ipv4/netfilter/ip_conntrack_proto_tcp.c  |    3 ++-
 3 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_proto_gre.c b/net/ipv4/netfilter/ip_conntrack_proto_gre.c
--- a/net/ipv4/netfilter/ip_conntrack_proto_gre.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_gre.c
@@ -247,6 +247,7 @@ static int gre_packet(struct ip_conntrac
 				   ct->proto.gre.stream_timeout);
 		/* Also, more likely to be important, and not a probe. */
 		set_bit(IPS_ASSURED_BIT, &ct->status);
+		ip_conntrack_event_cache(IPCT_STATUS, skb);
 	} else
 		ip_ct_refresh_acct(ct, conntrackinfo, skb,
 				   ct->proto.gre.timeout);
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -416,6 +416,7 @@ static int sctp_packet(struct ip_conntra
 		&& newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
 		DEBUGP("Setting assured bit\n");
 		set_bit(IPS_ASSURED_BIT, &conntrack->status);
+		ip_conntrack_event_cache(IPCT_STATUS, skb);
 	}
 
 	return NF_ACCEPT;
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -1014,7 +1014,8 @@ static int tcp_packet(struct ip_conntrac
 		/* Set ASSURED if we see see valid ack in ESTABLISHED 
 		   after SYN_RECV or a valid answer for a picked up 
 		   connection. */
-			set_bit(IPS_ASSURED_BIT, &conntrack->status);
+		set_bit(IPS_ASSURED_BIT, &conntrack->status);
+		ip_conntrack_event_cache(IPCT_STATUS, skb);
 	}
 	ip_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
 
-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]