hamza.kesraoui/sst-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
d0f491ccfd
sst-linux/net/netfilter
History
Xin Long 3fa58a6fbd netfilter: allow exp not to be removed in nf_ct_find_expectation 
commit 4914109a8e1e494c6aa9852f9e84ec77a5fc643f upstream.

Currently nf_conntrack_in() calling nf_ct_find_expectation() will
remove the exp from the hash table. However, in some scenario, we
expect the exp not to be removed when the created ct will not be
confirmed, like in OVS and TC conntrack in the following patches.

This patch allows exp not to be removed by setting IPS_CONFIRMED
in the status of the tmpl.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Aaron Conole <aconole@redhat.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-07 16:56:41 +01:00
..
ipset netfilter: ipset: Fix for recursive locking warning 2024-12-27 13:52:55 +01:00
ipvs ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() 2024-12-14 19:54:20 +01:00
core.c
Kconfig
Makefile
nf_conncount.c
nf_conntrack_acct.c
nf_conntrack_amanda.c
nf_conntrack_bpf.c
nf_conntrack_broadcast.c
nf_conntrack_core.c netfilter: allow exp not to be removed in nf_ct_find_expectation 2025-03-07 16:56:41 +01:00
nf_conntrack_ecache.c
nf_conntrack_expect.c netfilter: allow exp not to be removed in nf_ct_find_expectation 2025-03-07 16:56:41 +01:00
nf_conntrack_extend.c
nf_conntrack_ftp.c
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c
nf_conntrack_h323_types.c
nf_conntrack_helper.c
nf_conntrack_irc.c
nf_conntrack_labels.c
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS 2024-10-17 15:21:14 +02:00
nf_conntrack_pptp.c
nf_conntrack_proto_dccp.c
nf_conntrack_proto_generic.c
nf_conntrack_proto_gre.c
nf_conntrack_proto_icmp.c
nf_conntrack_proto_icmpv6.c
nf_conntrack_proto_sctp.c
nf_conntrack_proto_tcp.c
nf_conntrack_proto_udp.c
nf_conntrack_proto.c
nf_conntrack_sane.c
nf_conntrack_seqadj.c
nf_conntrack_sip.c
nf_conntrack_snmp.c
nf_conntrack_standalone.c
nf_conntrack_tftp.c
nf_conntrack_timeout.c
nf_conntrack_timestamp.c
nf_dup_netdev.c
nf_flow_table_core.c
nf_flow_table_inet.c
nf_flow_table_ip.c
nf_flow_table_offload.c
nf_flow_table_procfs.c
nf_hooks_lwtunnel.c
nf_internals.h
nf_log_syslog.c
nf_log.c
nf_nat_amanda.c
nf_nat_bpf.c
nf_nat_core.c
nf_nat_ftp.c
nf_nat_helper.c
nf_nat_irc.c
nf_nat_masquerade.c
nf_nat_proto.c
nf_nat_redirect.c
nf_nat_sip.c
nf_nat_tftp.c
nf_queue.c
nf_sockopt.c
nf_synproxy_core.c
nf_tables_api.c netfilter: nf_tables: reject mismatching sum of field_len with set key length 2025-02-21 13:49:25 +01:00
nf_tables_core.c
nf_tables_offload.c
nf_tables_trace.c
nfnetlink_acct.c
nfnetlink_cthelper.c
nfnetlink_cttimeout.c
nfnetlink_hook.c
nfnetlink_log.c
nfnetlink_osf.c
nfnetlink_queue.c
nfnetlink.c
nft_bitwise.c
nft_byteorder.c
nft_chain_filter.c
nft_chain_nat.c
nft_chain_route.c
nft_cmp.c
nft_compat.c
nft_connlimit.c
nft_counter.c
nft_ct.c netfilter: allow exp not to be removed in nf_ct_find_expectation 2025-03-07 16:56:41 +01:00
nft_dup_netdev.c
nft_dynset.c
nft_exthdr.c
nft_fib_inet.c
nft_fib_netdev.c
nft_fib.c
nft_flow_offload.c netfilter: nft_flow_offload: update tcp state flags under lock 2025-02-21 13:49:06 +01:00
nft_fwd_netdev.c
nft_hash.c
nft_immediate.c
nft_last.c
nft_limit.c
nft_log.c
nft_lookup.c netfilter: nf_tables: missing iterator type in lookup walk 2024-09-30 16:23:54 +02:00
nft_masq.c
nft_meta.c
nft_nat.c
nft_numgen.c
nft_objref.c
nft_osf.c
nft_payload.c netfilter: nft_payload: sanitize offset and length before calling skb_checksum() 2024-11-08 16:26:42 +01:00
nft_queue.c
nft_quota.c
nft_range.c
nft_redir.c
nft_reject_inet.c
nft_reject_netdev.c
nft_reject.c
nft_rt.c
nft_set_bitmap.c
nft_set_hash.c netfilter: nft_set_hash: skip duplicated elements pending gc run 2024-12-14 19:54:23 +01:00
nft_set_pipapo_avx2.c
nft_set_pipapo_avx2.h
nft_set_pipapo.c netfilter: nf_tables: missing iterator type in lookup walk 2024-09-30 16:23:54 +02:00
nft_set_pipapo.h
nft_set_rbtree.c
nft_socket.c netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level 2024-12-14 19:54:20 +01:00
nft_synproxy.c
nft_tproxy.c
nft_tunnel.c
nft_xfrm.c
utils.c
x_tables.c netfilter: Fix use-after-free in get_info() 2024-11-08 16:26:41 +01:00
xt_addrtype.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_AUDIT.c
xt_bpf.c
xt_cgroup.c
xt_CHECKSUM.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_CLASSIFY.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_cluster.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_comment.c
xt_connbytes.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_connlabel.c
xt_connlimit.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_connmark.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_CONNSECMARK.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_conntrack.c
xt_cpu.c
xt_CT.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c
xt_helper.c
xt_hl.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c
xt_l2tp.c
xt_LED.c netfilter: x_tables: fix LED ID check in led_tg_check() 2024-12-14 19:54:20 +01:00
xt_length.c
xt_limit.c
xt_LOG.c
xt_mac.c
xt_mark.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-11-01 01:56:04 +01:00
xt_MASQUERADE.c
xt_multiport.c
xt_nat.c
xt_NETMAP.c
xt_nfacct.c
xt_NFLOG.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-11-01 01:56:04 +01:00
xt_NFQUEUE.c
xt_osf.c
xt_owner.c
xt_physdev.c
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_rateest.c
xt_RATEEST.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_realm.c
xt_recent.c
xt_REDIRECT.c
xt_repldata.h
xt_sctp.c
xt_SECMARK.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-17 15:22:22 +02:00
xt_set.c
xt_socket.c
xt_state.c
xt_statistic.c
xt_string.c
xt_tcpmss.c
xt_TCPMSS.c
xt_TCPOPTSTRIP.c
xt_tcpudp.c
xt_TEE.c
xt_time.c
xt_TPROXY.c
xt_TRACE.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-11-01 01:56:04 +01:00
xt_u32.c