| Message ID | 20240308092915.9751-1-kerneljasonxing@gmail.com |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [net-next] netfilter: conntrack: dccp: try not to drop skb in conntrack | expand |
On Fri, Mar 8, 2024 at 5:29 PM Jason Xing <kerneljasonxing@gmail.com> wrote: > > From: Jason Xing <kernelxing@tencent.com> > > It would be better not to drop skb in conntrack unless we have good > alternative as Florian said[1]. So we can treat the result of testing > skb's header pointer as nf_conntrack_tcp_packet() does. > > [1] > Link: https://lore.kernel.org/all/20240307141025.GL4420@breakpoint.cc/ > > Signed-off-by: Jason Xing <kernelxing@tencent.com> > --- > net/netfilter/nf_conntrack_proto_dccp.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c > index e2db1f4ec2df..ebc4f733bb2e 100644 > --- a/net/netfilter/nf_conntrack_proto_dccp.c > +++ b/net/netfilter/nf_conntrack_proto_dccp.c > @@ -525,7 +525,7 @@ int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, > > dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh); > if (!dh) > - return NF_DROP; > + return -NF_ACCEPT; > > if (dccp_error(dh, skb, dataoff, state)) > return -NF_ACCEPT; > @@ -533,7 +533,7 @@ int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, > /* pull again, including possible 48 bit sequences and subtype header */ > dh = dccp_header_pointer(skb, dataoff, dh, &_dh); > if (!dh) > - return NF_DROP; > + return -NF_ACCEPT; > > type = dh->dccph_type; > if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh, state)) > -- > 2.37.3 > I saw the status in patchwork was changed, but I've not received the comments. So I spent some time learning how it works in the netfilter area. I just noticed that there are two trees (nf and nf-next), so should I target nf-next and resend this patch and another one[1]? [1]: https://lore.kernel.org/netfilter-devel/20240308092915.9751-2-kerneljasonxing@gmail.com/T/#m0ced362b380cff7e031d020e906ec2aa00669ce6 Thanks, Jason
On Mon, 11 Mar 2024 14:37:25 +0800 Jason Xing wrote: > I saw the status in patchwork was changed, but I've not received the > comments. So I spent some time learning how it works in the netfilter > area. > > I just noticed that there are two trees (nf and nf-next), so should I > target nf-next and resend this patch and another one[1]? I don't think you need to repost, you CCed the right people, they should be able to process the patches. But do keep in mind the netfilter trees on next patches.
On Mon, Mar 11, 2024 at 11:56 PM Jakub Kicinski <kuba@kernel.org> wrote: > > On Mon, 11 Mar 2024 14:37:25 +0800 Jason Xing wrote: > > I saw the status in patchwork was changed, but I've not received the > > comments. So I spent some time learning how it works in the netfilter > > area. > > > > I just noticed that there are two trees (nf and nf-next), so should I > > target nf-next and resend this patch and another one[1]? > > I don't think you need to repost, you CCed the right people, they > should be able to process the patches. But do keep in mind the > netfilter trees on next patches. Thanks for the clarification :)
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c index e2db1f4ec2df..ebc4f733bb2e 100644 --- a/net/netfilter/nf_conntrack_proto_dccp.c +++ b/net/netfilter/nf_conntrack_proto_dccp.c @@ -525,7 +525,7 @@ int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh); if (!dh) - return NF_DROP; + return -NF_ACCEPT; if (dccp_error(dh, skb, dataoff, state)) return -NF_ACCEPT; @@ -533,7 +533,7 @@ int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, /* pull again, including possible 48 bit sequences and subtype header */ dh = dccp_header_pointer(skb, dataoff, dh, &_dh); if (!dh) - return NF_DROP; + return -NF_ACCEPT; type = dh->dccph_type; if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh, state))