By default the kernel emits all ctnetlink events for a connection. This allows to select the types of events to generate. This can be used to e.g. only send DESTROY events but no NEW/UPDATE ones and will work even if sysctl net.netfilter.nf_conntrack_events is set to 0. This was already possible via iptables' CT target, but the nft version has the advantage that it can also be used with already-established conntracks. The added nf_ct_is_template() check isn't a bug fix as we only support mark and labels (and unlike ecache the conntrack core doesn't copy those).
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -901,6 +901,7 @@ enum nft_rt_attributes { · 900 unmodified lines | ||
| 901 | 901 | * @NFT_CT_BYTES: conntrack bytes |
| 902 | 902 | * @NFT_CT_AVGPKT: conntrack average bytes per packet |
| 903 | 903 | * @NFT_CT_ZONE: conntrack zone |
| 904 | + * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack | |
| 904 | 905 | */ |
| 905 | 906 | enum nft_ct_keys { |
| 906 | 907 | NFT_CT_STATE, |
| @@ -921,6 +922,7 @@ enum nft_ct_keys { · 14 unmodified lines | ||
| 921 | 922 | NFT_CT_BYTES, |
| 922 | 923 | NFT_CT_AVGPKT, |
| 923 | 924 | NFT_CT_ZONE, |
| 925 | + NFT_CT_EVENTMASK, | |
| 924 | 926 | }; |
| 925 | 927 | |
| 926 | 928 | /** |