* [PATCH] Apply userspace filter on resync with internal cache disabled
@ 2019-05-28 9:24 Robin Geuze
2019-05-30 14:44 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Robin Geuze @ 2019-05-28 9:24 UTC (permalink / raw)
To: netfilter-devel
Always apply the userspace filter when doing a direct sync from the kernel when internal cache is disabled, since a dump does not apply a kernelspace filter.
Signed-off-by: Robin Geuze <robing@transip.nl>
---
src/sync-notrack.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/sync-notrack.c b/src/sync-notrack.c
index 1b53e1b..b765c1a 100644
--- a/src/sync-notrack.c
+++ b/src/sync-notrack.c
@@ -72,6 +72,9 @@ static int kernel_resync_cb(enum nf_conntrack_msg_type type,
{
struct nethdr *net;
+ if (ct_filter_conntrack(ct, 1))
+ return NFCT_CB_CONTINUE;
+
net = BUILD_NETMSG_FROM_CT(ct, NET_T_STATE_CT_NEW);
multichannel_send(STATE_SYNC(channel), net);
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Apply userspace filter on resync with internal cache disabled
2019-05-28 9:24 [PATCH] Apply userspace filter on resync with internal cache disabled Robin Geuze
@ 2019-05-30 14:44 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2019-05-30 14:44 UTC (permalink / raw)
To: Robin Geuze; +Cc: netfilter-devel
On Tue, May 28, 2019 at 09:24:18AM +0000, Robin Geuze wrote:
> Always apply the userspace filter when doing a direct sync from the
> kernel when internal cache is disabled, since a dump does not apply
> a kernelspace filter.
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-05-30 14:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-28 9:24 [PATCH] Apply userspace filter on resync with internal cache disabled Robin Geuze
2019-05-30 14:44 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).