lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 028/453] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
    Date
    From: Brett Mastbergen <brett.mastbergen@gmail.com>

    [ Upstream commit 2d94b20b95b009eec1a267dcf026b01af627c0cd ]

    Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id
    hash calculation") the ct id will not change from initialization to
    confirmation. Removing the confirmation check allows for things like
    adding an element to a 'typeof ct id' set in prerouting upon reception
    of the first packet of a new connection, and then being able to
    reference that set consistently both before and after the connection
    is confirmed.

    Fixes: 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id hash calculation")
    Signed-off-by: Brett Mastbergen <brett.mastbergen@gmail.com>
    Acked-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nft_ct.c | 2 --
    1 file changed, 2 deletions(-)

    diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
    index 46ca8bcca1bd5..2042c6f4629cc 100644
    --- a/net/netfilter/nft_ct.c
    +++ b/net/netfilter/nft_ct.c
    @@ -177,8 +177,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
    }
    #endif
    case NFT_CT_ID:
    - if (!nf_ct_is_confirmed(ct))
    - goto err;
    *dest = nf_ct_get_id(ct);
    return;
    default:
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-28 14:39    [W:6.141 / U:0.180 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site