lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20230110133023.2366381-6-vladbu@nvidia.com> Date: Tue, 10 Jan 2023 14:30:21 +0100 From: Vlad Buslov <vladbu@...dia.com> To: <davem@...emloft.net>, <kuba@...nel.org>, <pabeni@...hat.com>, <pablo@...filter.org> CC: <netdev@...r.kernel.org>, <netfilter-devel@...r.kernel.org>, <jhs@...atatu.com>, <xiyou.wangcong@...il.com>, <jiri@...nulli.us>, <ozsh@...dia.com>, <marcelo.leitner@...il.com>, <simon.horman@...igine.com>, Vlad Buslov <vladbu@...dia.com> Subject: [PATCH net-next v1 5/7] net/sched: act_ct: set ctinfo in meta action depending on ct state Currently tcf_ct_flow_table_add_action_meta() function assumes that only established connections can be offloaded and always sets ctinfo to either IP_CT_ESTABLISHED or IP_CT_ESTABLISHED_REPLY strictly based on direction without checking actual connection state. To enable UDP NEW connection offload set the ctinfo and metadata cookie based on ct->status value. Signed-off-by: Vlad Buslov <vladbu@...dia.com> --- net/sched/act_ct.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 515577f913a3..bfddb462d2bc 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -182,8 +182,11 @@ static void tcf_ct_flow_table_add_action_meta(struct nf_conn *ct, #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) entry->ct_metadata.mark = READ_ONCE(ct->mark); #endif - ctinfo = dir == IP_CT_DIR_ORIGINAL ? IP_CT_ESTABLISHED : - IP_CT_ESTABLISHED_REPLY; + if (dir == IP_CT_DIR_ORIGINAL) + ctinfo = test_bit(IPS_SEEN_REPLY_BIT, &ct->status) ? + IP_CT_ESTABLISHED : IP_CT_NEW; + else + ctinfo = IP_CT_ESTABLISHED_REPLY; /* aligns with the CT reference on the SKB nf_ct_set */ entry->ct_metadata.cookie = (unsigned long)ct | ctinfo; entry->ct_metadata.orig_dir = dir == IP_CT_DIR_ORIGINAL; -- 2.38.1
Powered by blists - more mailing lists