netfilter: conntrack: avoid using ->error callback if possible

Browse source

The error() handler gets called before allocating or looking up a
connection tracking entry.

We can instead use direct calls from the ->packet() handlers which get
invoked for every packet anyway.

Only exceptions are icmp and icmpv6, these two special cases will be
handled in the next patch.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Florian Westphal 2018-09-12 15:19:10 +02:00 • committed by Pablo Neira Ayuso

parent 83d213fd9d

commit 0150ffbac7

3 changed files with 91 additions and 106 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

98

net/netfilter/nf_conntrack_proto_dccp.c

View file

67

net/netfilter/nf_conntrack_proto_sctp.c

View file

32

net/netfilter/nf_conntrack_proto_tcp.c

View file