* [PATCH nf] netfilter: nf_nat: don't bug when mapping already exists
@ 2017-08-31 11:45 Florian Westphal
2017-09-08 11:47 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Florian Westphal @ 2017-08-31 11:45 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
It seems preferrable to limp along if we have a conflicting mapping,
its certainly better than a BUG().
Signed-off-by: Florian Westphal <fw@strlen.de>
---
This can be triggered with nfqueue and bridge netfilter.
So far we found no good way to fix this problem (bridge netfilter
violates conntrack assumption wrt. ownership of ct by single cpu).
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index b1d3740ae36a..c1587e8427ef 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -416,7 +416,8 @@ nf_nat_setup_info(struct nf_conn *ct,
NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
maniptype == NF_NAT_MANIP_DST);
- BUG_ON(nf_nat_initialized(ct, maniptype));
+ if (WARN_ON(nf_nat_initialized(ct, maniptype)))
+ return NF_DROP;
/* What we've got will look like inverse of reply. Normally
* this is what is in the conntrack, except for prior
--
2.13.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nf] netfilter: nf_nat: don't bug when mapping already exists
2017-08-31 11:45 [PATCH nf] netfilter: nf_nat: don't bug when mapping already exists Florian Westphal
@ 2017-09-08 11:47 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2017-09-08 11:47 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Thu, Aug 31, 2017 at 01:45:24PM +0200, Florian Westphal wrote:
> It seems preferrable to limp along if we have a conflicting mapping,
> its certainly better than a BUG().
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-09-08 11:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-08-31 11:45 [PATCH nf] netfilter: nf_nat: don't bug when mapping already exists Florian Westphal
2017-09-08 11:47 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).