OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/net/netfilter
History
Pablo Neira Ayuso 590b52e10d netfilter: conntrack: skip clash resolution if nat is in place 
The clash resolution is not easy to apply if the NAT table is
registered. Even if no NAT rules are installed, the nul-binding ensures
that a unique tuple is used, thus, the packet that loses race gets a
different source port number, as described by:

http://marc.info/?l=netfilter-devel&m=146818011604484&w=2

Clash resolution with NAT is also problematic if addresses/port range
ports are used since the conntrack that wins race may describe a
different mangling that we may have earlier applied to the packet via
nf_nat_setup_info().

Fixes: 71d8c47fc6 ("netfilter: conntrack: introduce clash resolution on insertion race")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Marc Dionne <marc.c.dionne@gmail.com>
 		2016-07-12 16:28:41 +02:00
..
ipset netfilter: ipset: fix race condition in ipset save, swap and delete 2016-03-28 17:57:45 +02:00
ipvs ipvs: fix bind to link-local mcast IPv6 address in backup 2016-07-07 20:21:32 +02:00
Kconfig netfilter: tee: select NF_DUP_IPV6 unconditionally 2016-02-08 12:58:28 +01:00
Makefile netfilter: nf_tables: add forward expression to the netdev family 2016-01-04 17:48:38 +01:00
core.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-10-24 06:54:12 -07:00
nf_conntrack_acct.c netfilter: Remove uses of seq_<foo> return values 2015-03-18 10:51:35 +01:00
nf_conntrack_amanda.c net: Remove state argument from skb_find_text() 2015-02-22 15:59:54 -05:00
nf_conntrack_broadcast.c
…
nf_conntrack_core.c netfilter: conntrack: skip clash resolution if nat is in place 2016-07-12 16:28:41 +02:00
nf_conntrack_ecache.c netfilter: conntrack: move expectation event helper to ecache.c 2016-04-12 23:01:57 +02:00
nf_conntrack_expect.c netfilter: conntrack: use a single expectation table for all namespaces 2016-05-06 11:50:01 +02:00
nf_conntrack_extend.c
…
nf_conntrack_ftp.c netfilter: nf_ct_helper: Fix helper unregister count. 2016-05-30 12:21:22 +02:00
nf_conntrack_h323_asn1.c
…
nf_conntrack_h323_main.c ipv6: Remove external dependency on rt6i_gateway and RTF_ANYCAST 2015-05-25 13:25:33 -04:00
nf_conntrack_h323_types.c
…
nf_conntrack_helper.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2016-06-01 17:54:19 -07:00
nf_conntrack_irc.c netfilter: nf_ct_helper: Fix helper unregister count. 2016-05-30 12:21:22 +02:00
nf_conntrack_l3proto_generic.c netfilter: Convert print_tuple functions to return void 2014-11-05 14:10:33 -05:00
nf_conntrack_labels.c netfilter: connlabels: change nf_connlabels_get bit arg to 'highest used' 2016-04-18 20:39:48 +02:00
nf_conntrack_netbios_ns.c
…
nf_conntrack_netlink.c netfilter: conntrack: use a single expectation table for all namespaces 2016-05-06 11:50:01 +02:00
nf_conntrack_pptp.c netfilter: nf_conntrack: push zone object into functions 2015-08-11 12:29:01 +02:00
nf_conntrack_proto.c
…
nf_conntrack_proto_dccp.c libnl: nla_put_be64(): align on a 64-bit area 2016-04-23 20:13:24 -04:00
nf_conntrack_proto_generic.c netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple 2015-09-18 22:00:04 +02:00
nf_conntrack_proto_gre.c netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple 2015-09-18 22:00:04 +02:00
nf_conntrack_proto_sctp.c netfilter: conntrack: don't acquire lock during seq_printf 2016-04-19 20:26:25 +02:00
nf_conntrack_proto_tcp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2016-04-24 00:12:08 -04:00
nf_conntrack_proto_udp.c netfilter: conntrack: introduce clash resolution on insertion race 2016-05-05 16:39:50 +02:00
nf_conntrack_proto_udplite.c netfilter: conntrack: introduce clash resolution on insertion race 2016-05-05 16:39:50 +02:00
nf_conntrack_sane.c netfilter: nf_ct_helper: Fix helper unregister count. 2016-05-30 12:21:22 +02:00
nf_conntrack_seqadj.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_conntrack_sip.c netfilter: nf_ct_helper: Fix helper unregister count. 2016-05-30 12:21:22 +02:00
nf_conntrack_snmp.c
…
nf_conntrack_standalone.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2016-06-01 17:54:19 -07:00
nf_conntrack_tftp.c netfilter: nf_ct_helper: Fix helper unregister count. 2016-05-30 12:21:22 +02:00
nf_conntrack_timeout.c netfilter: cttimeout: add netns support 2015-12-14 12:48:58 +01:00
nf_conntrack_timestamp.c
…
nf_dup_netdev.c net: remove skb_sender_cpu_clear() 2016-03-01 17:36:47 -05:00
nf_internals.h netfilter: nf_queue: fix nf_queue_nf_hook_drop() 2015-07-23 16:17:58 +02:00
nf_log.c netfilter: nf_log: wait for rcu grace after logger unregistration 2015-09-17 13:37:31 +02:00
nf_log_common.c netfilter: bridge: add helpers for fetching physin/outdev 2015-04-08 16:49:08 +02:00
nf_nat_amanda.c
…
nf_nat_core.c netfilter: conntrack: use a single nat bysource table for all namespaces 2016-05-09 16:45:49 +02:00
nf_nat_ftp.c
…
nf_nat_helper.c
…
nf_nat_irc.c
…
nf_nat_proto_common.c
…
nf_nat_proto_dccp.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_nat_proto_sctp.c
…
nf_nat_proto_tcp.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_nat_proto_udp.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_nat_proto_udplite.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_nat_proto_unknown.c
…
nf_nat_redirect.c netfilter: nf_nat_redirect: add missing NULL pointer check 2015-10-27 06:54:56 +01:00
nf_nat_sip.c netfilter: replace strnicmp with strncasecmp 2014-10-14 02:18:24 +02:00
nf_nat_tftp.c
…
nf_queue.c netfilter: nf_queue: Make the queue_handler pernet 2016-05-25 11:54:22 +02:00
nf_sockopt.c
…
nf_synproxy_core.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2015-09-05 21:57:42 -07:00
nf_tables_api.c netfilter: nf_tables: fix memory leak if expr init fails 2016-06-23 14:15:24 +02:00
nf_tables_core.c netfilter: nf_tables: fix a wrong check to skip the inactive rules 2016-06-15 12:17:24 +02:00
nf_tables_inet.c netfilter: nf_tables: release objects on netns destruction 2015-12-28 18:34:35 +01:00
nf_tables_netdev.c netfilter: nf_tables_netdev: fix error path in module initialization 2016-01-18 13:53:37 +01:00
nf_tables_trace.c libnl: nla_put_be64(): align on a 64-bit area 2016-04-23 20:13:24 -04:00
nfnetlink.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-02-23 00:09:14 -05:00
nfnetlink_acct.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-05-15 13:32:48 -04:00
nfnetlink_cthelper.c netfilter: nfnetlink: pass down netns pointer to call() and call_rcu() 2015-12-28 18:41:41 +01:00
nfnetlink_cttimeout.c netfilter: conntrack: use a single hashtable for all namespaces 2016-05-05 16:39:47 +02:00
nfnetlink_log.c nfnetlink: remove nfnetlink_alloc_skb 2016-02-18 11:42:19 -05:00
nfnetlink_queue.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2016-06-01 17:54:19 -07:00
nft_bitwise.c netfilter: nf_tables: support variable sized data in nft_data_init() 2015-04-13 17:17:30 +02:00
nft_byteorder.c netfilter: nft_byteorder: avoid unneeded le/be conversion steps 2016-01-13 14:02:59 +01:00
nft_cmp.c netfilter: nf_tables: support variable sized data in nft_data_init() 2015-04-13 17:17:30 +02:00
nft_compat.c netfilter: nft_compat: check match/targetinfo attr size 2016-03-11 11:37:56 +01:00
nft_counter.c libnl: nla_put_be64(): align on a 64-bit area 2016-04-23 20:13:24 -04:00
nft_ct.c netfilter: nft_ct: fix expiration getter 2016-07-08 14:55:14 +02:00
nft_dup_netdev.c netfilter: nf_tables: add packet duplication to the netdev family 2016-01-03 21:04:23 +01:00
nft_dynset.c libnl: nla_put_be64(): align on a 64-bit area 2016-04-23 20:13:24 -04:00
nft_exthdr.c netfilter: nf_tables: switch registers to 32 bit addressing 2015-04-13 17:17:29 +02:00
nft_fwd_netdev.c netfilter: nf_tables: add forward expression to the netdev family 2016-01-04 17:48:38 +01:00
nft_hash.c netfilter: nf_tables: reject loops from set element jump to chain 2016-06-15 12:17:23 +02:00
nft_immediate.c netfilter: nf_tables: support variable sized data in nft_data_init() 2015-04-13 17:17:30 +02:00
nft_limit.c libnl: nla_put_be64(): align on a 64-bit area 2016-04-23 20:13:24 -04:00
nft_log.c netfilter: nf_tables: Use pkt->net instead of computing net from the passed net_devices 2015-09-18 21:58:49 +02:00
nft_lookup.c netfilter: nf_tables: add flag to indicate set contains expressions 2015-04-13 20:12:32 +02:00
nft_masq.c netfilter: nft_masq: support port range 2016-03-02 20:05:27 +01:00
nft_meta.c netfilter: nft_meta: set skb->nf_trace appropriately 2016-06-23 14:15:33 +02:00
nft_nat.c netfilter: nf_tables: switch registers to 32 bit addressing 2015-04-13 17:17:29 +02:00
nft_payload.c netfilter: nft_payload: add packet mangling support 2015-11-25 13:54:51 +01:00
nft_queue.c netfilter: nf_tables: kill nft_pktinfo.ops 2015-09-18 21:58:01 +02:00
nft_rbtree.c netfilter: nf_tables: reject loops from set element jump to chain 2016-06-15 12:17:23 +02:00
nft_redir.c netfilter: nf_tables: add register parsing/dumping helpers 2015-04-13 17:17:28 +02:00
nft_reject.c netfilter; Add some missing default cases to switch statements in nft_reject. 2015-04-27 13:20:34 -04:00
nft_reject_inet.c ipv4: Push struct net down into nf_send_reset 2015-09-29 20:21:31 +02:00
x_tables.c netfilter: x_tables: don't reject valid target size on some architectures 2016-06-02 14:09:33 +02:00
xt_AUDIT.c
…
xt_CHECKSUM.c
…
xt_CLASSIFY.c
…
xt_CONNSECMARK.c
…
xt_CT.c netfilter: cttimeout: add netns support 2015-12-14 12:48:58 +01:00
xt_DSCP.c netfilter: fix various sparse warnings 2014-11-13 12:14:42 +01:00
xt_HL.c
…
xt_HMARK.c
…
xt_IDLETIMER.c netfilter: IDLETIMER: fix race condition when destroy the target 2016-04-29 14:28:48 +02:00
xt_LED.c
…
xt_LOG.c netfilter: x_tables: Use par->net instead of computing from the passed net devices 2015-09-18 21:58:25 +02:00
xt_NETMAP.c
…
xt_NFLOG.c netfilter: x_tables: Use par->net instead of computing from the passed net devices 2015-09-18 21:58:25 +02:00
xt_NFQUEUE.c
…
xt_RATEEST.c net: sched: make bstats per cpu and estimator RCU safe 2014-09-30 01:02:26 -04:00
xt_REDIRECT.c netfilter: combine IPv4 and IPv6 nf_nat_redirect code in one module 2014-11-27 13:08:42 +01:00
xt_SECMARK.c
…
xt_TCPMSS.c netfilter: xt_TCPMSS: handle CHECKSUM_COMPLETE in tcpmss_tg6() 2016-01-18 12:18:17 +01:00
xt_TCPOPTSTRIP.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
xt_TEE.c netfilter: tee: select NF_DUP_IPV6 unconditionally 2016-02-08 12:58:28 +01:00
xt_TPROXY.c inet: refactor inet[6]_lookup functions to take skb 2016-02-11 03:54:14 -05:00
xt_TRACE.c
…
xt_addrtype.c netfilter: x_tables: Use par->net instead of computing from the passed net devices 2015-09-18 21:58:25 +02:00
xt_bpf.c
…
xt_cgroup.c netfilter: implement xt_cgroup cgroup2 path match 2015-12-14 20:34:55 +01:00
xt_cluster.c
…
xt_comment.c
…
xt_connbytes.c
…
xt_connlabel.c netfilter: connlabels: change nf_connlabels_get bit arg to 'highest used' 2016-04-18 20:39:48 +02:00
xt_connlimit.c netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple 2015-09-18 22:00:04 +02:00
xt_connmark.c
…
xt_conntrack.c
…
xt_cpu.c
…
xt_dccp.c
…
xt_devgroup.c
…
xt_dscp.c
…
xt_ecn.c
…
xt_esp.c
…
xt_hashlimit.c netfilter: Remove checks of seq_printf() return values 2014-11-05 14:11:02 -05:00
xt_helper.c
…
xt_hl.c
…
xt_ipcomp.c
…
xt_iprange.c
…
xt_ipvs.c ipvs: Pass ipvs into conn_out_get 2015-09-24 09:34:41 +09:00
xt_l2tp.c
…
xt_length.c
…
xt_limit.c
…
xt_mac.c
…
xt_mark.c netfilter: xt_MARK: Add ARP support 2015-05-14 13:00:27 +02:00
xt_multiport.c
…
xt_nat.c
…
xt_nfacct.c netfilter: nfacct: per network namespace support 2015-08-07 11:50:56 +02:00
xt_osf.c netfilter: xt_osf: remove unused variable 2016-02-29 13:59:43 +01:00
xt_owner.c netfilter: xt_owner: use skb_to_full_sk() helper 2015-11-08 20:56:39 -05:00
xt_physdev.c netfilter: physdev: use helpers 2015-04-08 16:49:09 +02:00
xt_pkttype.c
…
xt_policy.c
…
xt_quota.c
…
xt_rateest.c
…
xt_realm.c
…
xt_recent.c netfilter: x_tables: Use par->net instead of computing from the passed net devices 2015-09-18 21:58:25 +02:00
xt_repldata.h
…
xt_sctp.c
…
xt_set.c netfilter: ipset: Fix coding styles reported by checkpatch.pl 2015-06-14 10:40:18 +02:00
xt_socket.c tcp/dccp: do not touch listener sk_refcnt under synflood 2016-04-04 22:11:20 -04:00
xt_state.c
…
xt_statistic.c
…
xt_string.c net: Remove state argument from skb_find_text() 2015-02-22 15:59:54 -05:00
xt_tcpmss.c
…
xt_tcpudp.c
…
xt_time.c
…
xt_u32.c
…