From ed6a010330c0d5a08d36c7204f15ef86a787df9a Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Sun, 5 Aug 2018 07:09:24 +0000
Subject: [PATCH] Decode conntrack status from netlink

---
 probe/endpoint/conntrack/client.go |  3 +++
 probe/endpoint/conntrack/const.go  | 24 ++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/probe/endpoint/conntrack/client.go b/probe/endpoint/conntrack/client.go
index a9297b483..4d986b54c 100644
--- a/probe/endpoint/conntrack/client.go
+++ b/probe/endpoint/conntrack/client.go
@@ -169,6 +169,7 @@ type Flow struct {
 	Original Meta
 	Reply    Meta
 	State    TCPState
+	Status   CtStatus
 	ID       uint32
 }
 
@@ -205,6 +206,8 @@ func parsePayload(b []byte) (*Flow, error) {
 			parseProtoinfo(attr.Msg, flow)
 		case CtaId:
 			flow.ID = binary.BigEndian.Uint32(attr.Msg)
+		case CtaStatus:
+			flow.Status = CtStatus(binary.BigEndian.Uint32(attr.Msg))
 		}
 	}
 	return flow, nil
diff --git a/probe/endpoint/conntrack/const.go b/probe/endpoint/conntrack/const.go
index 895a4612c..c9a25af91 100644
--- a/probe/endpoint/conntrack/const.go
+++ b/probe/endpoint/conntrack/const.go
@@ -60,6 +60,30 @@ func (s TCPState) String() string {
 	}[s]
 }
 
+// Taken from include/uapi/linux/netfilter/nf_conntrack_common.h
+type CtStatus uint32
+
+const (
+	IPS_EXPECTED CtStatus = 1 << iota
+	IPS_SEEN_REPLY
+	IPS_ASSURED
+	IPS_CONFIRMED
+	IPS_SRC_NAT
+	IPS_DST_NAT
+	IPS_SEQ_ADJUST
+	IPS_SRC_NAT_DONE
+	IPS_DST_NAT_DONE
+	IPS_DYING
+	IPS_FIXED_TIMEOUT
+	IPS_TEMPLATE
+	IPS_UNTRACKED
+	IPS_HELPER
+	IPS_OFFLOAD
+
+	IPS_NAT_MASK      = (IPS_DST_NAT | IPS_SRC_NAT)
+	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE)
+)
+
 // Taken from libnetfilter_conntrack: git://git.netfilter.org/libnetfilter_conntrack
 // include/libnetfilter_conntrack/linux_nfnetlink_conntrack.h