path: root/include
diff options
authorPablo Neira Ayuso <>2013-07-11 00:43:20 +0200
committerPablo Neira Ayuso <>2013-07-11 02:42:55 +0200
commit586382d9a8389ee553db019fd9be14a8a7c0b8ec (patch)
tree5f00a12a32920319c95c5b0acafff0c9957131f5 /include
parent479a37a549abf197ce59a4ae1666d8cba80fe977 (diff)
conntrackd: simplify expectation filtering
This patch simplifies the expectation filtering by looking up for the master conntrack. If it does not exists, then we assume that we don't want this expectation either. This simplification also fixes the current broken expectation filtering, since the master conntrack from expectations has neither reply tuple nor state, however, the filtering code assumes the opposite. This partially reverts (479a37a conntrackd: fix crash with IPv6 expectation in the filtering code) since it was incorrectly setting the reply tuple of the master conntrack. Thanks to Bill Fink for providing feedback to resolve this issue. Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'include')
2 files changed, 2 insertions, 0 deletions
diff --git a/include/filter.h b/include/filter.h
index 3c7c8cc..d0acd96 100644
--- a/include/filter.h
+++ b/include/filter.h
@@ -51,6 +51,7 @@ void ct_filter_set_logic(struct ct_filter *f,
enum ct_filter_type type,
enum ct_filter_logic logic);
int ct_filter_conntrack(const struct nf_conntrack *ct, int userspace);
+int ct_filter_master(const struct nf_conntrack *master);
struct exp_filter;
struct nf_expect;
diff --git a/include/internal.h b/include/internal.h
index 2ba9714..1a796a7 100644
--- a/include/internal.h
+++ b/include/internal.h
@@ -40,6 +40,7 @@ struct internal_handler {
void (*new)(struct nf_expect *exp, int origin_type);
void (*upd)(struct nf_expect *exp, int origin_type);
int (*del)(struct nf_expect *exp, int origin_type);
+ int (*find)(const struct nf_conntrack *master);
void (*dump)(int fd, int type);
void (*populate)(struct nf_expect *exp);