[PATCH nf] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID

[PATCH nf] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID

[Brett Mastbergen]

Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id
hash calculation") the ct id will not change from initialization to
confirmation.  Removing the confirmation check allows for things like
adding an element to a 'typeof ct id' set in prerouting upon reception
of the first packet of a new connection, and then being able to
reference that set consistently both before and after the connection
is confirmed.

Signed-off-by: Brett Mastbergen <brett.mastbergen@gmail.com>
---
 net/netfilter/nft_ct.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 322bd674963e..a1b0aac46e9e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -177,8 +177,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
 	}
 #endif
 	case NFT_CT_ID:
-		if (!nf_ct_is_confirmed(ct))
-			goto err;
 		*dest = nf_ct_get_id(ct);
 		return;
 	default:
-- 
2.20.1

Re: [PATCH nf] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID

[Florian Westphal]

Brett Mastbergen <brett.mastbergen@gmail.com> wrote:
> Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id
> hash calculation") the ct id will not change from initialization to
> confirmation.  Removing the confirmation check allows for things like
> adding an element to a 'typeof ct id' set in prerouting upon reception
> of the first packet of a new connection, and then being able to
> reference that set consistently both before and after the connection
> is confirmed.

Acked-by: Florian Westphal <fw@strlen.de>

Re: [PATCH nf] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID

[Pablo Neira Ayuso]

On Tue, Dec 08, 2020 at 04:39:24PM -0500, Brett Mastbergen wrote:
> Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id
> hash calculation") the ct id will not change from initialization to
> confirmation.  Removing the confirmation check allows for things like
> adding an element to a 'typeof ct id' set in prerouting upon reception
> of the first packet of a new connection, and then being able to
> reference that set consistently both before and after the connection
> is confirmed.

Applied, thanks.