Florian Westphal 694a0055f0 netfilter: nft_ct: allow to set ctnetlink event types of a connection
By default the kernel emits all ctnetlink events for a connection.
This allows to select the types of events to generate.

This can be used to e.g. only send DESTROY events but no NEW/UPDATE ones
and will work even if sysctl net.netfilter.nf_conntrack_events is set to 0.

This was already possible via iptables' CT target, but the nft version has
the advantage that it can also be used with already-established conntracks.

The added nf_ct_is_template() check isn't a bug fix as we only support
mark and labels (and unlike ecache the conntrack core doesn't copy those).

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-04-19 17:55:16 +02:00
..
2017-01-22 16:46:13 -05:00
2016-12-03 23:54:25 -05:00
2017-02-21 13:25:22 -05:00
2017-04-15 11:51:33 +02:00
2017-04-15 11:51:33 +02:00
2016-12-25 17:21:22 +01:00
2016-10-20 11:23:08 -04:00
2017-01-24 11:07:35 +01:00
2017-03-29 14:10:11 -07:00
2017-03-29 13:26:22 -07:00