Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 08733a0c authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: handle NF_REPEAT from nf_conntrack_in() 



NF_REPEAT is only needed from nf_conntrack_in() under a very specific
case required by the TCP protocol tracker, we can handle this case
without returning to the core hook path. Handling of NF_REPEAT from the
nf_reinject() is left untouched.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 26dfab72

net/netfilter/core.c

+0 −2
Original line number Diff line number Diff line
@@ -322,8 +322,6 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, 
			if (ret == 0)

				ret = -EPERM;

			return ret;

		case NF_REPEAT:

			continue;

		case NF_QUEUE:

			ret = nf_queue(skb, state, &entry, verdict);

			if (ret == 1 && entry)

net/netfilter/nf_conntrack_core.c

+6 −5
Original line number Diff line number Diff line
@@ -1305,7 +1305,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum, 
		if (skb->nfct)

			goto out;

	}



repeat:

	ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum,

			       l3proto, l4proto, &set_reply, &ctinfo);

	if (!ct) {
@@ -1345,11 +1345,12 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum, 
		nf_conntrack_event_cache(IPCT_REPLY, ct);

out:

	if (tmpl) {

		/* Special case: we have to repeat this hook, assign the

		 * template again to this packet. We assume that this packet

		 * has no conntrack assigned. This is used by nf_ct_tcp. */

		/* Special case: TCP tracker reports an attempt to reopen a

		 * closed/aborted connection. We have to go back and create a

		 * fresh conntrack.

		 */

		if (ret == NF_REPEAT)

			skb->nfct = (struct nf_conntrack *)tmpl;

			goto repeat;

		else

			nf_ct_put(tmpl);

	}

net/openvswitch/conntrack.c

+2 −6
Original line number Diff line number Diff line
@@ -725,12 +725,8 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 
			skb->nfctinfo = IP_CT_NEW;

		}



		/* Repeat if requested, see nf_iterate(). */

		do {

		err = nf_conntrack_in(net, info->family,

				      NF_INET_PRE_ROUTING, skb);

		} while (err == NF_REPEAT);



		if (err != NF_ACCEPT)

			return -ENOENT;