Message ID | 20240103113001.137936-2-pablo@netfilter.org |
---|---|
State | Handled Elsewhere, archived |
Headers | show |
Series | [net,1/2] netfilter: nf_nat: fix action not being set for all ct states | expand |
Hello: This series was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Wed, 3 Jan 2024 12:30:00 +0100 you wrote: > From: Brad Cowie <brad@faucet.nz> > > This fixes openvswitch's handling of nat packets in the related state. > > In nf_ct_nat_execute(), which is called from nf_ct_nat(), ICMP/ICMPv6 > packets in the IP_CT_RELATED or IP_CT_RELATED_REPLY state, which have > not been dropped, will follow the goto, however the placement of the > goto label means that updating the action bit field will be bypassed. > > [...] Here is the summary with links: - [net,1/2] netfilter: nf_nat: fix action not being set for all ct states https://git.kernel.org/netdev/net/c/e6345d2824a3 - [net,2/2] netfilter: nft_immediate: drop chain reference counter on error https://git.kernel.org/netdev/net/c/b29be0ca8e81 You are awesome, thank you!
diff --git a/net/netfilter/nf_nat_ovs.c b/net/netfilter/nf_nat_ovs.c index 551abd2da614..0f9a559f6207 100644 --- a/net/netfilter/nf_nat_ovs.c +++ b/net/netfilter/nf_nat_ovs.c @@ -75,9 +75,10 @@ static int nf_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, } err = nf_nat_packet(ct, ctinfo, hooknum, skb); +out: if (err == NF_ACCEPT) *action |= BIT(maniptype); -out: + return err; }