-
Martin Willi authored
conntrack mark based dump filtering may falsely skip entries if a mask is given: If the mask-based check does not filter out the entry, the else-if check is always true and compares the mark without considering the mask. The if/else-if logic seems wrong. Given that the mask during filter setup is implicitly set to 0xffffffff if not specified explicitly, the mark filtering flags seem to just complicate things. Restore the previously used approach by always matching against a zero mask is no filter mark is given. Fixes: cb8aa9a3 ("netfilter: ctnetlink: add kernel side filtering for dump") Signed-off-by:
Martin Willi <martin@strongswan.org> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org>
6c0d95d1