* [PATCH nf] netfilter: conntrack: don't increment invalid counter on NF_REPEAT
@ 2022-01-13 20:37 Florian Westphal
2022-01-20 11:44 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Florian Westphal @ 2022-01-13 20:37 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
The packet isn't invalid, REPEAT means we're trying again after cleaning
out a stale connection, e.g. via tcp tracker.
This caused increases of invalid stat counter in a test case involving
frequent connection reuse, even though no packet is actually invalid.
Fixes: 56a62e2218f5 ("netfilter: conntrack: fix NF_REPEAT handling")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nf_conntrack_core.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 894a325d39f2..d6aa5b47031e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1924,15 +1924,17 @@ nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state)
pr_debug("nf_conntrack_in: Can't track with proto module\n");
nf_ct_put(ct);
skb->_nfct = 0;
- NF_CT_STAT_INC_ATOMIC(state->net, invalid);
- if (ret == -NF_DROP)
- NF_CT_STAT_INC_ATOMIC(state->net, drop);
/* Special case: TCP tracker reports an attempt to reopen a
* closed/aborted connection. We have to go back and create a
* fresh conntrack.
*/
if (ret == -NF_REPEAT)
goto repeat;
+
+ NF_CT_STAT_INC_ATOMIC(state->net, invalid);
+ if (ret == -NF_DROP)
+ NF_CT_STAT_INC_ATOMIC(state->net, drop);
+
ret = -ret;
goto out;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nf] netfilter: conntrack: don't increment invalid counter on NF_REPEAT
2022-01-13 20:37 [PATCH nf] netfilter: conntrack: don't increment invalid counter on NF_REPEAT Florian Westphal
@ 2022-01-20 11:44 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-20 11:44 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Thu, Jan 13, 2022 at 09:37:58PM +0100, Florian Westphal wrote:
> The packet isn't invalid, REPEAT means we're trying again after cleaning
> out a stale connection, e.g. via tcp tracker.
>
> This caused increases of invalid stat counter in a test case involving
> frequent connection reuse, even though no packet is actually invalid.
Applied to nf, thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-01-20 11:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-13 20:37 [PATCH nf] netfilter: conntrack: don't increment invalid counter on NF_REPEAT Florian Westphal
2022-01-20 11:44 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.