lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 30 May 2020 09:21:05 -0300 From: Marcelo Ricardo Leitner <marcelo.leitner@...il.com> To: wenxu@...oud.cn Cc: paulb@...lanox.com, netdev@...r.kernel.org Subject: Re: [PATCH v2] net/sched: act_ct: add nat mangle action only for NAT-conntrack On Sat, May 30, 2020 at 01:54:51PM +0800, wenxu@...oud.cn wrote: > From: wenxu <wenxu@...oud.cn> > > Currently add nat mangle action with comparing invert and ori tuple. Nit, "orig" ---^ > It is better to check IPS_NAT_MASK flags first to avoid non necessary > memcmp for non-NAT conntrack. > > Signed-off-by: wenxu <wenxu@...oud.cn> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@...il.com> > --- > net/sched/act_ct.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c > index 1a76639..2057735 100644 > --- a/net/sched/act_ct.c > +++ b/net/sched/act_ct.c > @@ -199,6 +199,9 @@ static int tcf_ct_flow_table_add_action_nat(struct net *net, > const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple; > struct nf_conntrack_tuple target; > > + if (!(ct->status & IPS_NAT_MASK)) > + return 0; > + > nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple); > > switch (tuple->src.l3num) { > -- > 1.8.3.1 >
Powered by blists - more mailing lists