Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 25db12f1 authored by Florian Westphal's avatar Florian Westphal Committed by Greg Kroah-Hartman
Browse files

netfilter: nat: avoid use of nf_conn_nat extension 



commit 6e699867f84c0f358fed233fe6162173aca28e04 upstream.

successful insert into the bysource hash sets IPS_SRC_NAT_DONE status bit
so we can check that instead of presence of nat extension which requires
extra deref.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent fd1ca9fe

net/netfilter/nf_conntrack_core.c

+1 −1
Original line number Diff line number Diff line
@@ -689,7 +689,7 @@ static int nf_ct_resolve_clash(struct net *net, struct sk_buff *skb, 


	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));

	if (l4proto->allow_clash &&

	    !nfct_nat(ct) &&

	    ((ct->status & IPS_NAT_DONE_MASK) == 0) &&

	    !nf_ct_is_dying(ct) &&

	    atomic_inc_not_zero(&ct->ct_general.use)) {

		nf_ct_acct_merge(ct, ctinfo, (struct nf_conn *)skb->nfct);

net/netfilter/nf_nat_core.c

+4 −14
Original line number Diff line number Diff line
@@ -550,10 +550,6 @@ struct nf_nat_proto_clean { 
static int nf_nat_proto_remove(struct nf_conn *i, void *data)

{

	const struct nf_nat_proto_clean *clean = data;

	struct nf_conn_nat *nat = nfct_nat(i);



	if (!nat)

		return 0;



	if ((clean->l3proto && nf_ct_l3num(i) != clean->l3proto) ||

	    (clean->l4proto && nf_ct_protonum(i) != clean->l4proto))
@@ -564,12 +560,10 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data) 


static int nf_nat_proto_clean(struct nf_conn *ct, void *data)

{

	struct nf_conn_nat *nat = nfct_nat(ct);



	if (nf_nat_proto_remove(ct, data))

		return 1;



	if (!nat)

	if ((ct->status & IPS_SRC_NAT_DONE) == 0)

		return 0;



	/* This netns is being destroyed, and conntrack has nat null binding.
@@ -705,11 +699,7 @@ EXPORT_SYMBOL_GPL(nf_nat_l3proto_unregister); 
/* No one using conntrack by the time this called. */

static void nf_nat_cleanup_conntrack(struct nf_conn *ct)

{

	struct nf_conn_nat *nat = nf_ct_ext_find(ct, NF_CT_EXT_NAT);



	if (!nat)

		return;



	if (ct->status & IPS_SRC_NAT_DONE)

		rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,

				nf_nat_bysource_params);

}