netfilter: fix checking method of conntrack helper
authorHsiuWen Yen <y.hsiuwen@gmail.com>
Thu, 31 Jan 2019 16:45:22 +0000 (00:45 +0800)
committerFelix Fietkau <nbd@nbd.name>
Sat, 9 Feb 2019 13:37:26 +0000 (14:37 +0100)
commit33b690216e766f2157871aa64190f9bb72334049
tree134ea05580c0362032ab68a0638226b82a48009d
parent61e01f248eb22ea9a4cffa862218f47970f3ab2c
netfilter: fix checking method of conntrack helper

This patch uses nfct_help() to detect whether an established connection
needs conntrack helper instead of using test_bit(IPS_HELPER_BIT,
&ct->status).

The reason for this modification is that IPS_HELPER_BIT is only set when
the conntrack helper is attached by explicit CT target.

However, in the case that a device enables conntrack helper via the other
ways (e.g., command "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper")
, the status of IPS_HELPER_BIT will not present any change. That means the
IPS_HELPER_BIT might lose the checking ability in the context.

Signed-off-by: HsiuWen Yen <y.hsiuwen@gmail.com>
target/linux/generic/hack-4.14/941-fix-checking-method-of-conntrack-helper.patch [new file with mode: 0644]