| Message ID | 1547459983-15724-1-git-send-email-henry.yen@mediatek.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | netfilter: fix checking method of conntrack helper | expand |
On 14/01/2019 10:59, Henry Yen wrote: > This patch uses nfct_help() to detect whether an > established connection needs conntrack helper instead of using > test_bit(IPS_HELPER_BIT, &ct->status). > > The reason is that IPS_HELPER_BIT is only set when using explicit > CT target. > > However, in the case that a device enables conntrack helper via > command "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper", > the status of IPS_HELPER_BIT will not present any change, and > consequently it loses the checking ability in the context. > > Signed-off-by: Henry Yen <henry.yen@mediatek.com> > Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Tested-by: John Crispin <john@phrozen.org> > --- > net/netfilter/nft_flow_offload.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c > index 974525eb92df..de4684cc4633 100644 > --- a/net/netfilter/nft_flow_offload.c > +++ b/net/netfilter/nft_flow_offload.c > @@ -12,6 +12,7 @@ > #include <net/netfilter/nf_conntrack_core.h> > #include <linux/netfilter/nf_conntrack_common.h> > #include <net/netfilter/nf_flow_table.h> > +#include <net/netfilter/nf_conntrack_helper.h> > > struct nft_flow_offload { > struct nft_flowtable *flowtable; > @@ -71,6 +72,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, > struct flow_offload *flow; > enum ip_conntrack_dir dir; > struct nf_conn *ct; > + const struct nf_conn_help *help; > int ret; > > if (nft_flow_offload_skip(pkt->skb)) > @@ -88,7 +90,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, > goto out; > } > > - if (test_bit(IPS_HELPER_BIT, &ct->status)) > + help = nfct_help(ct); > + if (help) > goto out; > > if (ctinfo == IP_CT_NEW ||
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index 974525eb92df..de4684cc4633 100644 --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c @@ -12,6 +12,7 @@ #include <net/netfilter/nf_conntrack_core.h> #include <linux/netfilter/nf_conntrack_common.h> #include <net/netfilter/nf_flow_table.h> +#include <net/netfilter/nf_conntrack_helper.h> struct nft_flow_offload { struct nft_flowtable *flowtable; @@ -71,6 +72,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, struct flow_offload *flow; enum ip_conntrack_dir dir; struct nf_conn *ct; + const struct nf_conn_help *help; int ret; if (nft_flow_offload_skip(pkt->skb)) @@ -88,7 +90,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, goto out; } - if (test_bit(IPS_HELPER_BIT, &ct->status)) + help = nfct_help(ct); + if (help) goto out; if (ctinfo == IP_CT_NEW ||