Re: [0/3] conntrack event kernel issues

[Patrick McHardy <kaber@trash.net>]

Fabian Hugelshofer wrote:
> Patrick McHardy wrote:
>>> Then there is this thing with the TCP RST. I think, that the event 
>>> data should be accurate. If the status is returned (with patch 1), 
>>> then it should have the SEEN_REPLY flag set. Another issue is that 
>>> the accounting counters are not updated. IMHO this should be done as 
>>> well (is not in my patches).
>>
>> Fully agreed about the counters. About the SEEN_REPLY bit - that
>> depends on how you define its meaning. So far its only set if
>> a valid reply for the connection is seen - which a RST isn't.
> 
> I consider a RST as a valid reply for a connection. It matches the tuple 
> and is in reply direction (ctinfo is set to IS_REPLY). Further the TCP 
> protocol handler returns no error. The SEEN_REPLY bit is actually set at 
> the end of nf_conntrack_in() but the destroy event is already triggered 
> by the TCP handler.
> 
> Increasing the counters in reply direction without setting the 
> SEEN_REPLY bit seems a bit weird to me.


OK, you've convinced me. If you send me a patch to update
the counters properly and set the SEEN_REPLY bit, I'll
apply it.