tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

netfilter: nf_conntrack: Add allow_clash to generic protocol handler

The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
("netfilter: conntrack: introduce clash resolution on insertion race"),
sets allow_clash=true in the UDP/UDPLITE protocol handler
but does not set it in the generic protocol handler.

As a result, packets composed of connectionless protocols at each layer,
such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.

To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.

Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>

authored by

Yuto Hamaguchi and committed by
Florian Westphal 8a49fc8d 6f93616a

+1
+1
net/netfilter/nf_conntrack_proto_generic.c
··· 67 67 const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = 68 68 { 69 69 .l4proto = 255, 70 + .allow_clash = true, 70 71 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 71 72 .ctnl_timeout = { 72 73 .nlattr_to_obj = generic_timeout_nlattr_to_obj,