diff options
| author | Brett Mastbergen <brett.mastbergen@gmail.com> | 2020-12-08 16:39:24 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-12-30 11:50:55 +0100 |
| commit | 3b79aea56dffcc7485a76eb654193ed2c8d19353 (patch) | |
| tree | f74aa8e621935bc7467beefa70a68915a1bcf408 /net/netfilter | |
| parent | 0a652b181d757c0ed88fc781b60e112e3f70af4b (diff) | |
netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
[ Upstream commit 2d94b20b95b009eec1a267dcf026b01af627c0cd ]
Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id
hash calculation") the ct id will not change from initialization to
confirmation. Removing the confirmation check allows for things like
adding an element to a 'typeof ct id' set in prerouting upon reception
of the first packet of a new connection, and then being able to
reference that set consistently both before and after the connection
is confirmed.
Fixes: 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id hash calculation")
Signed-off-by: Brett Mastbergen <brett.mastbergen@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nft_ct.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 46ca8bcca1bd..2042c6f4629c 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -177,8 +177,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr, } #endif case NFT_CT_ID: - if (!nf_ct_is_confirmed(ct)) - goto err; *dest = nf_ct_get_id(ct); return; default: |