Re: [0/3] conntrack event kernel issues

[Fabian Hugelshofer <hugelshofer2006@gmx.ch>]

Patrick McHardy wrote:
>> Then there is this thing with the TCP RST. I think, that the event 
>> data should be accurate. If the status is returned (with patch 1), 
>> then it should have the SEEN_REPLY flag set. Another issue is that the 
>> accounting counters are not updated. IMHO this should be done as well 
>> (is not in my patches).
> 
> Fully agreed about the counters. About the SEEN_REPLY bit - that
> depends on how you define its meaning. So far its only set if
> a valid reply for the connection is seen - which a RST isn't.

I consider a RST as a valid reply for a connection. It matches the tuple 
and is in reply direction (ctinfo is set to IS_REPLY). Further the TCP 
protocol handler returns no error. The SEEN_REPLY bit is actually set at 
the end of nf_conntrack_in() but the destroy event is already triggered 
by the TCP handler.

Increasing the counters in reply direction without setting the 
SEEN_REPLY bit seems a bit weird to me.