target/linux/generic/hack-4.14/941-fix-checking-method-of-conntrack-helper.patch

   1 From addf8974ce9987e2946e04624fe806a98390786e Mon Sep 17 00:00:00 2001
   2 From: HsiuWen Yen <y.hsiuwen@gmail.com>
   3 Date: Wed, 30 Jan 2019 11:45:25 +0800
   4 Subject: [PATCH] fix checking method of conntrack helper
   5
   6 This patch uses nfct_help() to detect whether an established connection
   7 needs conntrack helper instead of using test_bit(IPS_HELPER_BIT,
   8 &ct->status).
   9
  10 The reason for this modification is that IPS_HELPER_BIT is only set when
  11 the conntrack helper is attached by explicit CT target.
  12
  13 However, in the case that a device enables conntrack helper via the other
  14 ways (e.g., command "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper")
  15 , the status of IPS_HELPER_BIT will not present any change. That means the
  16 IPS_HELPER_BIT might lose the checking ability in the context.
  17
  18 Signed-off-by: HsiuWen Yen <y.hsiuwen@gmail.com>
  19 ---
  20  net/netfilter/xt_FLOWOFFLOAD.c             | 5 ++++-
  21  1 file changed, 4 insertions(+), 1 deletion(-)
  22
  23 --- a/net/netfilter/xt_FLOWOFFLOAD.c
  24 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
  25 @@ -12,6 +12,7 @@
  26  #include <net/ip.h>
  27  #include <net/netfilter/nf_conntrack.h>
  28  #include <net/netfilter/nf_flow_table.h>
  29 +#include <net/netfilter/nf_conntrack_helper.h>
  30
  31  static struct nf_flowtable nf_flowtable;
  32  static HLIST_HEAD(hooks);
  33 @@ -245,6 +246,7 @@ flowoffload_tg(struct sk_buff *skb, const struct xt_action_param *par)
  34         struct nf_flow_route route;
  35         struct flow_offload *flow;
  36         struct nf_conn *ct;
  37 +       const struct nf_conn_help *help;
  38
  39         if (xt_flowoffload_skip(skb))
  40                 return XT_CONTINUE;
  41 @@ -264,7 +266,8 @@ flowoffload_tg(struct sk_buff *skb, const struct xt_action_param *par)
  42                 return XT_CONTINUE;
  43         }
  44
  45 -       if (test_bit(IPS_HELPER_BIT, &ct->status))
  46 +       help = nfct_help(ct);
  47 +       if (help)
  48                 return XT_CONTINUE;
  49
  50         if (ctinfo == IP_CT_NEW ||
  51