netfilter: prefer extension check to pointer check

Browse source

The pointer check usually results in a 'false positive': its likely
that the ctnetlink module is loaded but no event monitoring is enabled.

After recent change to autodetect ctnetlink usage and only allocate
the ecache extension if a listener is active, check if the extension
is present on a given conntrack.

If its not there, there is nothing to report and calls to the
notification framework can be elided.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Florian Westphal 2022-04-25 15:15:44 +02:00 • committed by Pablo Neira Ayuso

parent 90d1daa458

commit 8edc813111

2 changed files with 16 additions and 17 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

include/net/netfilter/nf_conntrack_core.h

View file

31

include/net/netfilter/nf_conntrack_ecache.h

View file