41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
|
From ed875ee2dc98fe8fd7f5d171ec33a96606682495 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
||
|
|
Date: Mon, 8 Nov 2021 12:26:55 +0100
|
||
|
|
Subject: conntrackd: do not include conntrack ID in hashtable cmp
|
||
|
|
|
||
|
|
Depending on your conntrackd configuration, events might get lost,
|
||
|
|
leaving stuck entries in the cache forever. Skip checking the conntrack
|
||
|
|
ID to allow for lazy cleanup by when a new entry that is represented by
|
||
|
|
the same tuple is added.
|
||
|
|
|
||
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||
|
|
---
|
||
|
|
src/cache-ct.c | 11 +----------
|
||
|
|
1 file changed, 1 insertion(+), 10 deletions(-)
|
||
|
|
|
||
|
|
--- a/src/cache-ct.c
|
||
|
|
+++ b/src/cache-ct.c
|
||
|
|
@@ -88,21 +88,12 @@ cache_ct_hash(const void *data, const st
|
||
|
|
return ret;
|
||
|
|
}
|
||
|
|
|
||
|
|
-/* master conntrack of expectations have no ID */
|
||
|
|
-static inline int
|
||
|
|
-cache_ct_cmp_id(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
|
||
|
|
-{
|
||
|
|
- return nfct_attr_is_set(ct2, ATTR_ID) ?
|
||
|
|
- nfct_get_attr_u32(ct1, ATTR_ID) == nfct_get_attr_u32(ct2, ATTR_ID) : 1;
|
||
|
|
-}
|
||
|
|
-
|
||
|
|
static int cache_ct_cmp(const void *data1, const void *data2)
|
||
|
|
{
|
||
|
|
const struct cache_object *obj = data1;
|
||
|
|
const struct nf_conntrack *ct = data2;
|
||
|
|
|
||
|
|
- return nfct_cmp(obj->ptr, ct, NFCT_CMP_ORIG) &&
|
||
|
|
- cache_ct_cmp_id(obj->ptr, ct);
|
||
|
|
+ return nfct_cmp(obj->ptr, ct, NFCT_CMP_ORIG);
|
||
|
|
}
|
||
|
|
|
||
|
|
static void *cache_ct_alloc(void)
|