Looks good, only one more little change and we go. On Tue, Jun 04, 2019 at 04:34:23PM +0800, xiao ruizhu wrote: [...] > @@ -420,8 +421,10 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) > } > h = nf_ct_expect_dst_hash(net, &expect->tuple); > hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) { > - if (expect_matches(i, expect)) { > - if (i->class != expect->class) > + if ((flags & NF_CT_EXP_F_CHECK_MASTER ? true : i->master == > + expect->master) && expect_matches(i, expect)) { Could you add a function for this? eg. static bool nf_ct_check_master(struct nf_conntrack_expect *a, struct nf_conntrack_expect *b) { if (flags & NF_CT_EXP_F_CHECK_MASTER) return true; return i->master == expect->master && expect_matches(i, expect); } Was that the intention? I'm a bit confused with the use of the single statement branch above. Thanks! > + if (i->class != expect->class || > + i->master != expect->master) > return -EALREADY; > > if (nf_ct_remove_expect(i))