Go to file
Florian Westphal c46172147e netfilter: conntrack: do not auto-delete clash entries on reply
Its possible that we have more than one packet with the same ct tuple
simultaneously, e.g. when an application emits n packets on same UDP
socket from multiple threads.

NAT rules might be applied to those packets. With the right set of rules,
n packets will be mapped to m destinations, where at least two packets end
up with the same destination.

When this happens, the existing clash resolution may merge the skb that
is processed after the first has been received with the identical tuple
already in hash table.

However, its possible that this identical tuple is a NAT_CLASH tuple.
In that case the second skb will be sent, but no reply can be received
since the reply that is processed first removes the NAT_CLASH tuple.

Do not auto-delete, this gives a 1 second window for replies to be passed
back to originator.

Packets that are coming later (udp stream case) will not be affected:
they match the original ct entry, not a NAT_CLASH one.

Also prevent NAT_CLASH entries from getting offloaded.

Fixes: 6a757c07e5 ("netfilter: conntrack: allow insertion of clashing entries")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-08-29 13:03:06 +02:00
arch powerpc fixes for 5.9 #3 2020-08-23 11:37:23 -07:00
block block-5.9-2020-08-14 2020-08-15 20:36:42 -07:00
certs .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2020-08-14 13:09:15 -07:00
Documentation dt-bindings: net: dsa: Fix typo 2020-08-24 18:03:29 -07:00
drivers net: dsa: mt7530: fix advertising unsupported 1000baseT_Half 2020-08-28 06:54:06 -07:00
fs RxRPC fixes 2020-08-27 12:55:46 -07:00
include netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS 2020-08-28 20:11:58 +02:00
init OpenRISC updates for 5.9 2020-08-14 14:04:53 -07:00
ipc ipc/shm.c: remove the superfluous break 2020-08-12 10:58:02 -07:00
kernel A single bug fix for the common entry code. The transcript of the x86 2020-08-23 11:05:47 -07:00
lib lib/string.c: Use freestanding environment 2020-08-19 11:23:45 -07:00
LICENSES LICENSES: Rename other to deprecated 2019-05-03 06:34:32 -06:00
mm mm, page_alloc: fix core hung in free_pcppages_bulk() 2020-08-21 09:52:53 -07:00
net netfilter: conntrack: do not auto-delete clash entries on reply 2020-08-29 13:03:06 +02:00
samples Kbuild updates for v5.9 2020-08-09 14:10:26 -07:00
scripts kconfig: qconf: replace deprecated QString::sprintf() with QTextStream 2020-08-21 10:23:38 +09:00
security Merge branch 'akpm' (patches from Andrew) 2020-08-12 11:24:12 -07:00
sound sound fixes for 5.9-rc2 2020-08-21 10:07:54 -07:00
tools selftests: netfilter: add command usage 2020-08-28 20:12:00 +02:00
usr Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-08-07 13:29:39 -07:00
virt * PAE and PKU bugfixes for x86 2020-08-22 10:03:05 -07:00
.clang-format block: add bio_for_each_bvec_all() 2020-05-25 11:25:24 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: Add ZSTD-compressed files 2020-07-31 11:50:49 +02:00
.mailmap Merge branch 'akpm' (patches from Andrew) 2020-08-21 14:44:48 -07:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS CREDITS: Replace HTTP links with HTTPS ones 2020-07-23 14:53:58 -06:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS MAINTAINERS: Remove self from PHY LIBRARY 2020-08-24 16:18:47 -07:00
Makefile kbuild: remove redundant patterns in filter/filter-out 2020-08-18 20:16:46 +09:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.