Re: [PATCH nf] netfilter: connmark: ignore skbs with magic untracked conntrack objects

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sat, Oct 29, 2016 at 03:01:50AM +0200, Florian Westphal wrote:
> The (percpu) untracked conntrack entries can end up with nonzero connmarks.
> 
> The 'untracked' conntrack objects are merely a way to distinguish INVALID
> (i.e. protocol connection tracker says payload doesn't meet some
> requirements or packet was never seen by the connection tracking code)
> from packets that are intentionally not tracked (some icmpv6 types such as
> neigh solicitation, or by using 'iptables -j CT --notrack' option).
> 
> Untracked conntrack objects are implementation detail, we might as well use
> invalid magic address instead to tell INVALID and UNTRACKED apart.

We may consider recovering this old idea: https://lwn.net/Articles/141489/

> Check skb->nfct for untracked dummy and behave as if skb->nfct is NULL.
> 
> Reported-by: XU Tianwen <evan.xu.tianwen@gmail.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> Here is the formal submit of earlier RFC patch, I also fixed
> connmark match; conceptually UNTRACKED is not a conntrack object
> so such skb should always fail the match.

Applied, thanks.