On Sat, Mar 9, 2024 at 6:47 AM Florian Westphal <fw@xxxxxxxxx> wrote: > > Jason Xing <kerneljasonxing@xxxxxxxxx> wrote: > > > connection. Feel free to send patches that replace drop with -accept > > > where possible/where it makes sense, but I don't think the > > > TCP_CONNTRACK_SYN_SENT one can reasonably be avoided. > > > > Oh, are you suggesting replacing NF_DROP with -NF_ACCEPT in > > nf_conntrack_dccp_packet()? > > It would be more consistent with what tcp and sctp trackers are > doing, but this should not matter in practice (the packet is malformed). Okay, I will take some time to check the sctp part. BTW, just like one of previous emails said, I noticed there are two points in DCCP part which is not consistent with TCP part, so I submitted one simple patch [1] to do it. [1]: https://lore.kernel.org/all/20240308092915.9751-1-kerneljasonxing@xxxxxxxxx/ > > > > + case NFCT_TCP_INVALID: { > > > + verdict = -NF_ACCEPT; > > > + if (ct->status & IPS_NAT_MASK) > > > + res = NF_DROP; /* skb would miss nat transformation */ > > > > Above line, I guess, should be 'verdict = NF_DROP'? > > Yes. > > > Great! I think your draft patch makes sense really, which takes NAT > > into consideration. > > You could submit this officially and we could give it a try and see if > anyone complains down the road. Great :) Thanks, Jason
