summaryrefslogtreecommitdiff
path: root/net/netfilter
diff options
context:
space:
mode:
authorBrett Mastbergen <brett.mastbergen@gmail.com>2020-12-08 16:39:24 -0500
committerPablo Neira Ayuso <pablo@netfilter.org>2020-12-09 10:31:58 +0100
commit2d94b20b95b009eec1a267dcf026b01af627c0cd (patch)
treeb90bed322948a1eb53823d2b4d293f0224445d17 /net/netfilter
parent42f1c27120906a54e73101a7d6a12f58813f6a9f (diff)
downloadlinux-next-2d94b20b95b009eec1a267dcf026b01af627c0cd.tar.gz
netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id hash calculation") the ct id will not change from initialization to confirmation. Removing the confirmation check allows for things like adding an element to a 'typeof ct id' set in prerouting upon reception of the first packet of a new connection, and then being able to reference that set consistently both before and after the connection is confirmed. Fixes: 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id hash calculation") Signed-off-by: Brett Mastbergen <brett.mastbergen@gmail.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
-rw-r--r--net/netfilter/nft_ct.c2
1 files changed, 0 insertions, 2 deletions
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 322bd674963e..a1b0aac46e9e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -177,8 +177,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
}
#endif
case NFT_CT_ID:
- if (!nf_ct_is_confirmed(ct))
- goto err;
*dest = nf_ct_get_id(ct);
return;
default: