Re: [0/3] conntrack event kernel issues

[Pablo Neira Ayuso <pablo@netfilter.org>]

Patrick McHardy wrote:
> Fabian Hugelshofer wrote:
>> Patrick McHardy wrote:
>>>> patch1: export ct->status on all conntrack events
>>>> patch2: set SEEN_REPLY before destroying a conntrack on TCP RST
>>>> patch3: new status flag SEEN_RELATED
>>>
>>> I can't imagine other uses for this than the one you described,
>>> especially for 2 and 3. Patch 3 also adds code in a hot path,
>>> so unless someone can present good arguments in favour of these
>>> patches, I don't really want to apply them.
>>
>> This is what I had expected. Especially for patch 3 I know that it's 
>> very unlikely to be integrated because of its limited use and the 
>> changes it makes.
>>
>> For not exporting the connection status on a destroy event I see no 
>> reason. The information is there and should be exported. Might also be 
>> interesting to have the EXPECTED or ASSURED flags.
> 
> Yes, that one I'm fine with.

Indeed. It makes sense.

>> Then there is this thing with the TCP RST. I think, that the event 
>> data should be accurate. If the status is returned (with patch 1), 
>> then it should have the SEEN_REPLY flag set. Another issue is that the 
>> accounting counters are not updated. IMHO this should be done as well 
>> (is not in my patches).
> 
> Fully agreed about the counters. About the SEEN_REPLY bit - that
> depends on how you define its meaning. So far its only set if
> a valid reply for the connection is seen - which a RST isn't.

I'm bit lost about the thing related with the counters, what do you mean?

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers