tree d24ef0638fbfbf4dcda30f9fef205912fefc8442
parent ab8bc7ed864b9c4f1fcb00a22bbe4e0f66ce8003
author Florian Westphal <fw@strlen.de> 1492277170 +0200
committer Pablo Neira Ayuso <pablo@netfilter.org> 1492617316 +0200

netfilter: nft_ct: allow to set ctnetlink event types of a connection

By default the kernel emits all ctnetlink events for a connection.
This allows to select the types of events to generate.

This can be used to e.g. only send DESTROY events but no NEW/UPDATE ones
and will work even if sysctl net.netfilter.nf_conntrack_events is set to 0.

This was already possible via iptables' CT target, but the nft version has
the advantage that it can also be used with already-established conntracks.

The added nf_ct_is_template() check isn't a bug fix as we only support
mark and labels (and unlike ecache the conntrack core doesn't copy those).

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>