• Florian Westphal's avatar
    netfilter: nfnetlink: re-enable conntrack expectation events · 0b2f3212
    Florian Westphal authored
    To avoid allocation of the conntrack extension area when possible,
    the default behaviour was changed to only allocate the event extension
    if a userspace program is subscribed to a notification group.
    
    Problem is that while 'conntrack -E' does enable the event allocation
    behind the scenes, 'conntrack -E expect' does not: no expectation events
    are delivered unless user sets
    "net.netfilter.nf_conntrack_events" back to 1 (always on).
    
    Fix the autodetection to also consider EXP type group.
    
    We need to track the 6 event groups (3+3, new/update/destroy for events and
    for expectations each) independently, else we'd disable events again
    if an expectation group becomes empty while there is still an active
    event group.
    
    Fixes: 2794cdb0 ("netfilter: nfnetlink: allow to detect if ctnetlink listeners exist")
    Reported-by: default avatarYi Chen <yiche@redhat.com>
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    0b2f3212
nfnetlink.c 19.2 KB