| Message ID | AM0PR02MB549235F7DFDD08E5C47E2B0AAA1E0@AM0PR02MB5492.eurprd02.prod.outlook.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | Apply userspace filter on resync with internal cache disabled | expand |
On Tue, May 28, 2019 at 09:24:18AM +0000, Robin Geuze wrote: > Always apply the userspace filter when doing a direct sync from the > kernel when internal cache is disabled, since a dump does not apply > a kernelspace filter. Applied, thanks.
diff --git a/src/sync-notrack.c b/src/sync-notrack.c index 1b53e1b..b765c1a 100644 --- a/src/sync-notrack.c +++ b/src/sync-notrack.c @@ -72,6 +72,9 @@ static int kernel_resync_cb(enum nf_conntrack_msg_type type, { struct nethdr *net; + if (ct_filter_conntrack(ct, 1)) + return NFCT_CB_CONTINUE; + net = BUILD_NETMSG_FROM_CT(ct, NET_T_STATE_CT_NEW); multichannel_send(STATE_SYNC(channel), net);
Always apply the userspace filter when doing a direct sync from the kernel when internal cache is disabled, since a dump does not apply a kernelspace filter. Signed-off-by: Robin Geuze <robing@transip.nl> --- src/sync-notrack.c | 3 +++ 1 file changed, 3 insertions(+)