Re: [PATCH nf] netfilter: ctnetlink: fix mark based dump filtering regression

2020-09-08 Thread Pablo Neira Ayuso
On Tue, Sep 01, 2020 at 08:56:19AM +0200, Martin Willi wrote: > conntrack mark based dump filtering may falsely skip entries if a mask > is given: If the mask-based check does not filter out the entry, the > else-if check is always true and compares the mark without considering > the mask. The if/e

[PATCH nf] netfilter: ctnetlink: fix mark based dump filtering regression

2020-09-01 Thread Martin Willi
conntrack mark based dump filtering may falsely skip entries if a mask is given: If the mask-based check does not filter out the entry, the else-if check is always true and compares the mark without considering the mask. The if/else-if logic seems wrong. Given that the mask during filter setup is