Commit 830af2eb authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: don't increment invalid counter on NF_REPEAT 



The packet isn't invalid, REPEAT means we're trying again after cleaning
out a stale connection, e.g. via tcp tracker.

This caused increases of invalid stat counter in a test case involving
frequent connection reuse, even though no packet is actually invalid.

Fixes: 56a62e22 ("netfilter: conntrack: fix NF_REPEAT handling")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7d70984a

net/netfilter/nf_conntrack_core.c

+5 −3
Original line number Diff line number Diff line
@@ -1924,15 +1924,17 @@ nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state) 
		pr_debug("nf_conntrack_in: Can't track with proto module\n");

		nf_ct_put(ct);

		skb->_nfct = 0;

		NF_CT_STAT_INC_ATOMIC(state->net, invalid);

		if (ret == -NF_DROP)

			NF_CT_STAT_INC_ATOMIC(state->net, drop);

		/* Special case: TCP tracker reports an attempt to reopen a

		 * closed/aborted connection. We have to go back and create a

		 * fresh conntrack.

		 */

		if (ret == -NF_REPEAT)

			goto repeat;



		NF_CT_STAT_INC_ATOMIC(state->net, invalid);

		if (ret == -NF_DROP)

			NF_CT_STAT_INC_ATOMIC(state->net, drop);



		ret = -ret;

		goto out;

	}