path: root/src/run.c
diff options
authorPablo Neira Ayuso <>2012-07-30 02:22:58 +0200
committerPablo Neira Ayuso <>2012-07-30 02:22:58 +0200
commit3cd88a6d9c66360dad983578259ab92ba083fca8 (patch)
treec373f88f6279a79465d17ad6598550fbdc174e3a /src/run.c
parent7eb63b5872f07903d952aa5cfd6ad0e7647a066a (diff)
conntrackd: implement selective flushing for `-t' and `-F' commands
This patch changes the current behaviour of `-t' and `-F' commands, that results in flushing the kernel conntrack table. With this patch, the entries that match the Filter clauses in conntrackd.conf are ignored. This fixes the situation in which some local ssh connection to the firewall is lost during the failover (since `-t' is invoked from the script). Note that the Filter clause tells what entries have to be ignored, ie. the entries that do not need to be replicated. It makes sense not to flush entries that are not replicated (usually traffic to the local firewall). Reported-by: Gaurav Sinha <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'src/run.c')
1 files changed, 1 insertions, 1 deletions
diff --git a/src/run.c b/src/run.c
index 26c1783..421ff41 100644
--- a/src/run.c
+++ b/src/run.c
@@ -196,7 +196,7 @@ static void local_flush_master(void)
* meanwhile the parent process handles events. */
if (fork_process_new(CTD_PROC_FLUSH, CTD_PROC_F_EXCL,
NULL, NULL) == 0) {
- nl_flush_conntrack_table(STATE(flush));
+ nl_flush_conntrack_table_selective();