1 From addf8974ce9987e2946e04624fe806a98390786e Mon Sep 17 00:00:00 2001
2 From: HsiuWen Yen <y.hsiuwen@gmail.com>
3 Date: Wed, 30 Jan 2019 11:45:25 +0800
4 Subject: [PATCH] fix checking method of conntrack helper
6 This patch uses nfct_help() to detect whether an established connection
7 needs conntrack helper instead of using test_bit(IPS_HELPER_BIT,
10 The reason for this modification is that IPS_HELPER_BIT is only set when
11 the conntrack helper is attached by explicit CT target.
13 However, in the case that a device enables conntrack helper via the other
14 ways (e.g., command "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper")
15 , the status of IPS_HELPER_BIT will not present any change. That means the
16 IPS_HELPER_BIT might lose the checking ability in the context.
18 Signed-off-by: HsiuWen Yen <y.hsiuwen@gmail.com>
20 net/netfilter/xt_FLOWOFFLOAD.c | 5 ++++-
21 1 file changed, 4 insertions(+), 1 deletion(-)
23 --- a/net/netfilter/xt_FLOWOFFLOAD.c
24 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
27 #include <net/netfilter/nf_conntrack.h>
28 #include <net/netfilter/nf_flow_table.h>
29 +#include <net/netfilter/nf_conntrack_helper.h>
31 static struct nf_flowtable nf_flowtable;
32 static HLIST_HEAD(hooks);
33 @@ -245,6 +246,7 @@ flowoffload_tg(struct sk_buff *skb, const struct xt_action_param *par)
34 struct nf_flow_route route;
35 struct flow_offload *flow;
37 + const struct nf_conn_help *help;
39 if (xt_flowoffload_skip(skb))
41 @@ -264,7 +266,8 @@ flowoffload_tg(struct sk_buff *skb, const struct xt_action_param *par)
45 - if (test_bit(IPS_HELPER_BIT, &ct->status))
46 + help = nfct_help(ct);
50 if (ctinfo == IP_CT_NEW ||